13497 matches found
CVE-2019-16664
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
CVE-2019-16659
TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...
Design/Logic Flaw
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
Cross site request forgery (csrf)
TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...
Design/Logic Flaw
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
Cross site request forgery (csrf)
TuziCMS 2.0.6 has index.php/manage/notice/doadd CSRF...
CVE-2019-16664
ThinkSAAS 2.91 is affected by CVE-2019-16664: an XSS via the parameter groupname in index.php?app=group&ac=create&ts=do. Root cause described across sources is insufficient sanitization of the groupname input, enabling cross-site scripting. Affected product/version: ThinkSAAS 2.91. The Red Hat ad...
CVE-2019-16658
TuziCMS 2.0.6 is affected by a CSRF vulnerability in the endpoint index.php/manage/notice/do_add . The provided documents identify the root cause as a CSRF issue at that endpoint. No exploitation specifics or remediation steps are given in the sources. If present, check for interim mitigations; o...
CVE-2019-16659
The connected sources confirm CVE-2019-16659 affects TuziCMS 2.0.6, describing a CSRF issue in index.php/manage/link/do_add. The root cause is a Cross-Site Request Forgery vulnerability in that endpoint, enabling unauthorized state-changing requests from a logged-in user. Exploit details, affecte...
PT-2019-14750
Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered that allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupname parameter. Recommendations For ThinkSAAS version 2.91, consider restricting...
PT-2019-14744
Name of the Vulnerable Software and Affected Versions TuziCMS version 2.0.6 Description The issue concerns a CSRF vulnerability in the index.php/manage/link/do add endpoint. This vulnerability may allow unauthorized actions to be performed. Recommendations For TuziCMS version 2.0.6, consider...
PT-2019-14743
Name of the Vulnerable Software and Affected Versions TuziCMS version 2.0.6 Description The issue concerns a CSRF vulnerability in the index.php/manage/notice/do add endpoint. This allows for potential unauthorized actions. Recommendations For TuziCMS version 2.0.6, consider implementing proper...
PT-2019-14751
Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered where there is a potential for XSS via the content to the "index.php?app=group&ac=comment&ts=do&js=1" URI. This can be demonstrated by a crafted SVG document in the SRC attribute of an...
CVE-2019-16664: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
CVE-2019-16665: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-16659: Cross-Site Request Forgery (CSRF)
TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...
CVE-2019-16658: Cross-Site Request Forgery (CSRF)
TuziCMS 2.0.6 has index.php/manage/notice/doadd CSRF...
PT-2019-14742
Name of the Vulnerable Software and Affected Versions TuziCMS version 2.0.6 Description The issue concerns an XSS vulnerability that can be triggered via the PATH INFO to a group URI. This is demonstrated by accessing index.php/article/group/id/2/, which allows for potential malicious script...