13099 matches found
GHSA-J2HG-W4P4-6RVM EC-CUBE vulnerable to authorization bypass
Authorization bypass through user-controlled key issue exists in EC-CUBE 2.11.0 through 2.12.2 and EC-Orange systems deployed before June 29th, 2015. If this vulnerability is exploited, a user of the affected shopping website may obtain other users' information by sending a crafted HTTP request...
GHSA-PWPQ-632G-H49G Plone Privilege escalation due improper authorization
Multiple unspecified vulnerabilities in 1 dataitems.py, 2 get.py, and 3 traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors...
GHSA-M76J-69C2-C3M8 TYPO3 vulnerable to remote authenticated arbitrary code execution
The File Abstraction Layer FAL in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250...
GHSA-H7WF-JG4F-X2WC TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is known, which allows remote attackers to bypass authentication and gain access to the backend by leveraging knowledge of a...
GeSHi vulnerable to Cross-site Scripting
Cross-site scripting XSS vulnerability in contrib/langwiz.php in GeSHi before 1.0.8.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
GHSA-X626-Q4V7-7XC6 Neo4J vulnerable to Cross-Site Request Forgery
Multiple cross-site request forgery CSRF vulnerabilities in Neo4J 1.9.2 allow remote attackers to hijack the authentication of administrators for requests that execute arbitrary code, as demonstrated by a request to 1 db/data/ext/GremlinPlugin/graphdb/executescript or 2 db/manage/server/console/...
yag and pt_extbase extensions for TYPO3 allow remote attackers to bypass access restrictions
The Ajax dispatcher for Extbase in the Yet Another Gallery yag extension before 3.0.1 and Tools for Extbase development ptextbase extension before 1.5.1 allows remote attackers to bypass access restrictions and execute arbitrary controller actions via unspecified vectors...
TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism
The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors...
TYPO3 Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field...
Jenkins Vulnerable to Clickjacking
Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors...
GHSA-H52H-972R-68MH Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)
Cross-site scripting XSS vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
GHSA-6W8C-6JRG-QWJ2 Radicale regex metacharacters injection in the user name
Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by...
phpMyAdmin allows remote attackers to spoof content via the url parameter
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter...
GHSA-4WCC-JV3P-PRQW Cherry Music Cross-site Scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist...
GHSA-J76Q-99X2-V7VQ Apache Ambari Improper Access Control
Custom commands may be executed on Ambari Agent 2.4.x, before 2.4.2 hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agen...
GHSA-R64J-5W3W-FP49 TeamPass vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...
MODX Revolution cross-site scripting vulnerability
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...
GHSA-V7QF-22RW-CHPH MantisBT XSS via adm_config_report.php's action parameter
A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...
GHSA-XVX2-WQF5-JJGV typo3/cms-felogin Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...