CVE-2021-36545

Cross Site Scripting XSS vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfgcopyright or cfgtel field in Site Configuration page...

CVE-2021-36545

Cross Site Scripting XSS vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfgcopyright or cfgtel field in Site Configuration page...

CVE-2021-36545

The CVE-2021-36545 entry refers to a Cross-Site Scripting (XSS) vulnerability in tpcms version 3.2 where the cfg_copyright and cfg_tel fields in the Site Configuration page can be exploited to run arbitrary code remotely. Affected software: tpcms 3.2; vulnerable component: Site Configuration inpu...

TPCMS 跨站脚本漏洞

TPCMS is a source of happiness Source of Happiness individual developers of an open source content management system. A cross-site scripting vulnerability exists in TPCMS version 3.2. A remote attacker can exploit this vulnerability to run arbitrary code via the cfgcopyright or cfgtel fields in t...

PT-2023-12288 · Tpcms · Tpcms

Name of the Vulnerable Software and Affected Versions: tpcms version 3.2 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the cfg copyright or cfg tel field in the Site Configuration page. This enables attackers to execute malicious scripts on the...

CVE-2021-36545

Cross Site Scripting XSS vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfgcopyright or cfgtel field in Site Configuration page...

CVE-2022-4705 Royal Elementor Addons <= 1.3.59 - Insufficient Access Control to Template Activation

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wprfinalsettingssetup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset...

PT-2022-24279 · Esri · Arcgis Server

Name of the Vulnerable Software and Affected Versions: Esri ArcGIS Server versions 10.9.1 and below Description: The issue allows a remote, unauthenticated attacker to traverse the file system and access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure o...

Information Disclosure

typo3 is vulnerable to information disclosure. The vulnerability exists because the library does not properly handle user-submitted YAML placeholder expressions in the site configuration backend module which allows an attacker to access sensitive information of the system...

CVE-2022-23504

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers coul...

Information disclosure

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers coul...

CVE-2022-23504 TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers coul...

CVE-2022-23504 TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers coul...

TYPO3 Sensitive Information Disclosure Vulnerability (TYPO3-CORE-SA-2022-016)

TYPO3 is prone to a sensitive information disclosure vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C 5.3 Problem Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive internal information, such as system configuration or HTTP request messag...

TYPO3-CORE-SA-2022-016: Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-016...

TYPO3-CORE-SA-2022-016: Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-016...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 Core, which can be exploited by an attacker to read sensitive information by bypassing access restrictions to TYPO3 Core data via site configurati...

PT-2022-6443 · Nokia · Nokia Netact

Name of the Vulnerable Software and Affected Versions: Nokia NetAct versions prior to 22 SP1037 Description: An issue was discovered in the Site Configuration Tool tab of Nokia NetAct, where attackers can upload a ZIP file that, when processed, exploits Stored XSS. The upload option of the Site...

PT-2022-03: Stored Cross-Site Scripting (XSS)

Since the Site Configuration tool has an upload option, it doesn’t validate the file contents. An attacker can upload a Zip file which, when processed, exploits Stored XSS. The attack can only be performed by an internal user. NetAct 22 SP1037 is already delivered on top of NetAct 22 FP2208, SP...