PT-2023-6024 · Jenkins · Jenkins Fortify Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Fortify Plugin versions 22.1.38 and earlier Description: A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs, capturing credentials stored i...

PT-2023-16575 · Opennms · Meridian +1

Name of the Vulnerable Software and Affected Versions: OpenNMS Horizon versions 31.0.8 through 32.0.2 Description: The issue is related to an XML external entity XXE injection vulnerability in the /rtc/post/ endpoint, which can be used to force Horizon to make arbitrary HTTP requests to internal...

CVE-2023-3584 Member can create team with team override scheme

Mattermost fails to properly check the authorization of POST /api/v4/teams when passing a team override scheme ID in the request, allowing an authenticated attacker with knowledge of a Team Override Scheme ID to create a new team with said team override scheme...

PT-2023-24485 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: XXL-Job version 2.4.1 Description: A lateral privilege escalation issue allows users to execute arbitrary commands on another user's account via a crafted POST request to the "/jobinfo/" API endpoint. Recommendations: For XXL-Job version 2.4....

PT-2022-27476 · Yith · Yith Woocommerce Gift Cards

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Gift Cards premium plugin versions 3.19.0 and earlier Description: The issue is related to an Unauth. Arbitrary File Upload vulnerability in the YITH WooCommerce Gift Cards premium plugin on WordPress, which allows unauthoriz...

PT-2022-27470 · Aerocms · Aerocms

Name of the Vulnerable Software and Affected Versions: AeroCMS version 0.0.1 Description: The issue allows attackers to access database information through a SQL Injection vulnerability. This vulnerability is exploited via the p id parameter at the "/post.php" API endpoint. Recommendations: For...

CVE-2022-30310

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

PT-2022-17134 · Jenkins · Jenkins Autonomiq Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins autonomiq Plugin versions 1.15 and earlier Description: A cross-site request forgery CSRF vulnerability exists due to the lack of permission checks in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to ...

CVE-2021-44838

An issue was discovered in Delta RM 1.2. Using the /risque/risque/ajax-details endpoint, with a POST request indicating the risk to access with the id parameter, it is possible for users to access risks of other companies...

PT-2019-11802 · Jenkins · Jenkins Project Inheritance Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Project Inheritance Plugin version 2.0.0 and earlier Description: A cross-site request forgery issue exists due to a missing permission check in an HTTP endpoint that triggers project creation from templates. This allowed users with...

PT-2019-7738 · Pagelines +1 · Pagelines +1

Name of the Vulnerable Software and Affected Versions: PageLines theme version 1.1.4 Description: The issue concerns a CSRF vulnerability in the PageLines theme for WordPress. It affects the "wp-admin/admin-post.php?page=pagelines" endpoint. Recommendations: For PageLines theme version 1.1.4,...

PT-2019-13831 · WordPress · Rank Math Seo

Name of the Vulnerable Software and Affected Versions: Rank Math SEO plugin version 1.0.27 Description: The issue allows non-admin users to reset settings. This is achieved via the wp-admin/admin-post.php endpoint, specifically through the reset-cmb parameter. Recommendations: For Rank Math SEO...

PT-2019-9056 · Lg · Lg N1A1 Nas

Name of the Vulnerable Software and Affected Versions: LG N1A1 NAS version 3718.510 Description: The issue allows for remote command execution, enabling the execution of arbitrary code. The attack vector involves an HTTP POST request with specific parameters. Recommendations: For LG N1A1 NAS...

CVE-2018-18427

s-cms 3.0 allows SQL Injection via the member/post.php 0id parameter or the POST data to member/memberlogin.php...

PT-2018-13279

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description An issue was discovered in MiniCMS. There is a post.php?date= XSS vulnerability. Recommendations For MiniCMS version 1.10, update to a version that fixes the XSS vulnerability in the post.php endpoint,...