5442 matches found
PT-2018-15023
Name of the Vulnerable Software and Affected Versions ShowDoc version 2.4.2 Description The issue allows for a CSRF attack, which can be used to add members to a team. The affected endpoint is "server/index.php?s=/api/teamMember/save". This can potentially lead to unauthorized modifications to te...
CVE-2018-19544
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...
Cross site request forgery (csrf)
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
CVE-2018-19545
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
CVE-2018-19544
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...
CVE-2018-19545
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
PT-2018-14989
Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/content/save" API endpoint to add news. Recommendations For JEECMS version 9.3, as a temporary workaround, consider restricting access to the "api/admin/content/save"...
PT-2018-14990
Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/role/save" API endpoint to add a user. Recommendations For JEECMS version 9.3, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions...
JEECMS Cross-Site Request Forgery Vulnerability (CNVD-2018-26785)
JEECMS is a set of China Jinlei technology development company using Java language development of content management system CMS. A cross-site request forgery vulnerability exists in JEECMS version 9.3. A remote attacker can exploit this vulnerability to add news with the help of...
CVE-2018-19545: Cross-Site Request Forgery (CSRF)
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...
JEECMS Cross-Site Request Forgery Vulnerability
JEECMS is a set of China Jinlei Technology Development Corporation using Java language development of content management systems CMS. A cross-site request forgery vulnerability exists in JEECMS version 9.3. A remote attacker can use api/admin/role/save URI to add users...
CVE-2018-19544: Cross-Site Request Forgery (CSRF)
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news...
CVE-2018-19060
An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path...
FruityWifi Code Execution Vulnerability
FruityWifi is a wireless network auditing tool. A security vulnerability exists in the www/modules/save.php file in FruityWifi 2.4 and earlier versions. A remote attacker can exploit this vulnerability by sending a specially crafted 'modname' parameter via a POST request to execute arbitrary code...
Design/Logic Flaw
Shell Metacharacter Injection in www/modules/save.php in FruityWifi aka PatatasFritas/PatataWifi through 2.4 allows remote attackers to execute arbitrary code with root privileges via a crafted modname parameter in a POST request. NOTE: unlike in CVE-2018-17317, the attacker does not need a valid...
Cross-site Scripting Vulnerability in Tianti CMS (CNVD-2019-09099)
Ladder tianti is a free lightweight CMS system written in Java. A stored cross-site scripting vulnerability exists in the user list module in tianti 2.3, which can be exploited by an attacker via the tianti-module-admin/user/ajax/saverole name parameter to conduct a cross-site scripting attack...
UBUNTU-CVE-2018-19060
An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demonstrated by utils/pdfdetach.cc not validating a filename of an embedded file before constructing a save path...
UBUNTU-CVE-2018-12402
The internal WebBrowserPersist code does not use correct origin context for a resource being saved. This manifests when sub-resources are loaded as part of "Save Page As..." functionality. For example, a malicious page could recover a visitor's Windows username and NTLM hash by including resource...
