BossCMS V1.1 Arbitrary File Download Vulnerability in Background

BossCMS is a safe, stable, good, permanent free open source, independent research and development of PHP framework for enterprise building system. BossCMS background arbitrary file download vulnerability, attackers can use the vulnerability to download any file in the server...

1broker (=0.1.1), @abbott-platform/abbott-framework (>=1.6.1 <=1.6.7) +1264 more potentially affected by CVE-2022-0654 via requestretry (>=1.0.4 <=6.0.0)

requestretry NPM version =1.0.4, =1.6.1, =1.3.0, =1.0.3, =0.0.1, =1.1.0-RC.1, =1.3.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.3.0, =2.11.0 and more Source cves: CVE-2022-0654 Source advisory: OSV:GHSA-HJP8-2CM3-CC45...

a62-emotion (>=0.10.12 <=0.11.4), agent-atm (>=0.1.0 <=0.1.1) +102 more potentially affected by CVE-2022-21736 via tensorflow-cpu (>=1.15.0 <=2.4.4)

tensorflow-cpu PYPI version =1.15.0, =0.10.12, =0.1.0, =2.0.0, =2.0.0, =1.0.0, =0.0.5, =0.3.0, =0.0.1, =0.8.1, =0.1.1, =1.3.0, =0.1.0.dev1, =0.1.0.dev202107081840 and more Source cves: CVE-2022-21736 Source advisory: OSV:GHSA-PFJJ-M3JJ-9JC9...

rpnet (>=0.0.1 <=0.1.0), rpnet-dev (>=0.0.5 <=0.0.12) +4 more potentially affected by unknown CVE via tensorflow-gpu (=2.7.0)

tensorflow-gpu PYPI version =2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-gpu and may be impacted: - rpnet =0.0.1, =0.0.5, =1.0.5, =1.1.1 - tpu-tf2 =1.0.0 - troj =1.0.0 Source cves: unknown CVE Source advisory: OSV:GHSA-43Q8-3FV7-PR...

Snipe-IT Access Control Error Vulnerability

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...

complaintclassify (=0.0.9) potentially affected by CVE-2021-37666 via tensorflow-cpu (=2.4.0)

tensorflow-cpu PYPI version =2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - complaintclassify =0.0.9 Source cves: CVE-2021-37666 Source advisory: OSV:PYSEC-2021-579...

eth-brownie (=1.15.0) potentially affected by unknown CVE via vyper (=0.2.14)

vyper PYPI version =0.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on vyper and may be impacted: - eth-brownie =1.15.0 Source cves: unknown CVE Source advisory: OSV:GHSA-7F92-RR6W-CQ64...

c4v-py (>=0.1.0.dev1 <=0.1.0.dev202107081840) potentially affected by CVE-2021-29596 via tensorflow-cpu (=2.3.1)

tensorflow-cpu PYPI version =2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - c4v-py =0.1.0.dev1, =0.1.0.dev202107081840 Source cves: CVE-2021-29596 Source advisory: OSV:GHSA-4VRF-FF7V-HPGR...

Logic Flaw Vulnerability in ZZCMS Backend

ZZCMS is a completely open source based on PHP, ASP's product investment website management system , project investment website management system , enterprise website management system . ZZCMS back-end logic flaws vulnerabilities. Attackers can use the vulnerability to perform unauthorized...

complaintclassify (=0.0.9) potentially affected by CVE-2021-29520 via tensorflow-cpu (=2.4.0)

tensorflow-cpu PYPI version =2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - complaintclassify =0.0.9 Source cves: CVE-2021-29520 Source advisory: OSV:PYSEC-2021-448...

axosnake (>=0.1.0 <=0.1.4), bevy_rapier2d (>=0.1.1 <=0.4.0) +22 more potentially affected by unknown CVE via ncollide2d (>=0.15.4 <=0.33.0)

ncollide2d CARGO version =0.15.4, =0.1.0, =0.1.1, =0.0.0, =0.14.0, =0.0.1, =0.1.0, =0.15.3, =0.8.0, =0.1.0, =0.5.0, =0.5.0, =0.5.0, =0.46.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2021-0151...

aglvq (=1.0.0), beacon-trellis (=0.1.0) +64 more potentially affected by CVE-2020-26271 via tensorflow (>=2.1.0 <=2.1.2)

tensorflow PYPI version =2.1.0, =3.0.0, =0.0.1, =0.2.0, =0.0.2, =0.1.0, =1.1.0, =0.2.0rc1, =0.2.0rc3 and more Source cves: CVE-2020-26271 Source advisory: OSV:PYSEC-2020-257...

a3m (=0.1.0), acdh-collatex-utils (>=0.2.0 <=1.2.0) +542 more potentially affected by CVE-2020-27783 via lxml (>=3.2.3 <=4.6.1)

lxml PYPI version =3.2.3, =0.2.0, =1.0.0, =3.0.0, =0.1.0, =1.0.3, =1.0.0a1.post0, =1.10.0, =0.1.16, =0.7.2, =1.0.1, =1.0.3 and more Source cves: CVE-2020-27783 Source advisory: OSV:PYSEC-2020-62...

fleek-response (>=0.4.2 <=0.4.3), fleek-router (>=0.4.2 <=1.2.3) potentially affected by unknown CVE via swagger-injector (>=1.2.0 <=2.0.9)

swagger-injector NPM version =1.2.0, =0.4.2, =0.4.2, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-V4X8-GW49-7HV4...

@ardibos/taekbos (=1.1.4), @conlan2/cmpt315as2 (>=1.0.0 <=1.0.1) +8 more potentially affected by unknown CVE via public (=0.1.5)

public NPM version =0.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on public and may be impacted: - @ardibos/taekbos =1.1.4 - @conlan2/cmpt315as2 =1.0.0, =1.0.8, =0.1.0, =0.1.2 - weektwoabc =1.0.0 - wjwrk9 =1.0.1 - yyjchhym =1.0.0 Source cves:...

com.github.davidmoten:odata-client-test-olingo-trip-pin (=0.2.6), com.github.davidmoten:odata-client-test-report (>=0.1.14 <=0.2.5) +1 more potentially affected by CVE-2019-17556 via org.apache.olingo:odata-client-proxy (>=4.0.0 <=4.6.0)

org.apache.olingo:odata-client-proxy MAVEN version =4.0.0, =0.1.14, =4.0.0, =4.10.0 Source cves: CVE-2019-17556 Source advisory: OSV:GHSA-GJ76-429M-56WC...

Arbitrary file deletion vulnerability in Bacardi CMS pi***.php page

Bacardi CMS micro-mall is a free and open source object-oriented multi-store multi-user micro-mall PHP development framework , created in June 2014 , follow the Apache Licence2 open source agreement released , is to quickly simplify the development of enterprise micro-mall applications , to help...

aero.champ:cargojson (=1.0), ai.active:webhook-sdk (>=1.0.0 <=1.0.4) +30803 more potentially affected by CVE-2019-14439 via com.fasterxml.jackson.core:jackson-databind (>=2.9.0 <=2.9.9.1)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.9.0, =1.0.0, =4.4.0.0, =0.0.1, =0.0.6, =0.0.1, =0.0.1, =thread-pool-0.0.24-dev, =local, =local, =0.0.6, =0.0.1, =0.1.2, =0.1.7 - ai.genauth:genauth-java-sdk =3.1.11 - ai.grakn.kgms:client =1.4.3 and more Source cves: CVE-2019-14439 Sour...

com.cibuddy:karaf.assembly (=1.0.0), com.kagurabi.services:kagura-assembly (>=1.5 <=1.9) +28 more potentially affected by CVE-2016-8750 via org.apache.karaf:apache-karaf (>=2.0.0 <=4.0.7)

org.apache.karaf:apache-karaf MAVEN version =2.0.0, =1.5, =1.5.6, =4.4.1, =1.1.2, =1.0.0, =2.0.0, =2.0.6, =1.0, =2.18.0, =2.7.7, =3.0.0, =1.6.1-incubating, =1.6.1-incubating, =2.0.3 and more Source cves: CVE-2016-8750 Source advisory: OSV:GHSA-CHJ8-5XGW-WCVJ...

ShopsN open source online store full system RechargeController page there are code execution vulnerabilities

ShopsN free version of the B2C e-commerce is a Shanghai Yisu Network Technology Co., Ltd. in line with the enterprise-level commercial standards full-featured really allow free commercial use of open source online store full network system. ShopsN v2.3.5 official version of the RechargeController...