111 matches found
CVE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value...
EUVD-2015-6851
Malware in sbrugna...
EUVD-2011-4245
Malware in sbrugna...
CVE-2021-41765
A SQL injection issue in pages/editfields/9ajax/addkeyword.php of ResourceSpace 9.5 and 9.6 rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user...
CVE-2021-41950
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the...
CVE-2011-4311
ResourceSpace before 4.2.2833 does not properly validate access keys, which allows remote attackers to bypass intended resource restrictions via unspecified vectors...
CVE-2015-6915
SQL injection vulnerability in Montala Limited ResourceSpace 7.3.7009 and earlier allows remote attackers to execute arbitrary SQL commands via the "user" cookie to plugins/feedback/pages/feedback.php...
BIT-RESOURCESPACE-2021-41765
A SQL injection issue in pages/editfields/9ajax/addkeyword.php of ResourceSpace 9.5 and 9.6 rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user...
BIT-RESOURCESPACE-2021-41950
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the...
BIT-RESOURCESPACE-2021-41951
ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpresssso/pages/index.php via the wordpressuser parameter. If an attacker is able to persuade a victim to visit a crafted URL, malicious JavaScript content may be executed within the...
BIT-RESOURCESPACE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value...
Montala Limited ResourceSpace Cross-Site Scripting (CVE-2021-41951)
A reflected cross-site scripting vulnerability exists in ResourceSpace by Montala Limited. The vulnerability is due to improper input validation of user input passed to index.php page...
Montala Limited ResourceSpace Arbitrary File Deletion (CVE-2021-41950)
An arbitrary file deletion vulnerability exists in ResourceSpace by Montala Limited. The vulnerability is due to unsanitized parameters used in the titles.php page...
ResourceSpace Code Execution
The vulnerability of the pages/editfields/9ajax/addkeyword.php implementation of the ResourceSpace digital asset management system lies in the lack of measures taken to protect the SQL query structure during the processing of the k parameter. Exploiting this vulnerability can allow an attacker,...
CVE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value...
CVE-2022-31260
In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value...
Design/Logic Flaw
In Montala ResourceSpace through 9.8 before r19636, csvexportresultsmetadata.php allows attackers to export collection metadata via a non-NULL k value...
CVE-2022-31260
ResourceSpace CVE-2022-31260 affects Montala ResourceSpace up to version 9.8 prior to r19636. The flaw is in csv_export_results_metadata.php, where an attacker can export collection metadata by providing a non-NULL k value. Impact: unauthorized access to metadata. Mitigation: upgrade to the fixed...
