5385 matches found
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server’s server lies in the improper elimination of certain elements in the output data, allowing attackers to execute arbitrary commands.
The vulnerability of Hitachi Vantara Pentaho Business Analytics Server relates to the incorrect elimination of certain elements in the output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by injecting specially crafted Spring templates...
CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream...
CVE-2022-43769
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream...
Design/Logic Flaw
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream...
CVE-2022-43769 Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream...
Hitachi Vantara Pentaho Business Analytics Server 代码注入漏洞
Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration, and business analytics platform from Hitachi, Ltd Hitachi, Japan. A code injection vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server that originates from allowing certain web services...
Cross-Site Request Forgery (CSRF)
moodle is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the resetalltemplates parameter of actionbar.php because the CSRF token was not properly validated, which allows an attacker to access sensitive information and reset all the database activity templates...
CVE-2023-28733
AnyMailing Joomla Plugin Enterprise versions prior to 8.3.0 are affected by a stored XSS in templates and emails of AcyMailing. The vulnerability is exploitable without authentication when access to the campaign creation on the front office is granted. The root cause is a stored cross-site script...
LISTSERV 17 - Reflected Cross Site Scripting Vulnerability
Exploit Title: LISTSERV 17 - Reflected Cross Site Scripting XSS Google Dork: inurl:/scripts/wa.exe Exploit Author: Shaunt Der-Grigorian Vendor Homepage: https://www.lsoft.com/ Software Link: https://www.lsoft.com/download/listserv.asp Version: 17 Tested on: Windows Server 2019 CVE : CVE-2022-3919...
LISTSERV 17 - Reflected Cross Site Scripting (XSS)
Exploit Title: LISTSERV 17 - Reflected Cross Site Scripting XSS Google Dork: inurl:/scripts/wa.exe Date: 12/01/2022 Exploit Author: Shaunt Der-Grigorian Vendor Homepage: https://www.lsoft.com/ Software Link: https://www.lsoft.com/download/listserv.asp Version: 17 Tested on: Windows Server 2019 CV...
myBB forums 1.8.26 - Stored Cross-Site Scripting Vulnerability
Exploit Title: myBB forums 1.8.26 - Stored Cross-Site Scripting XSS Exploit Author: Andrey Stoykov Software Link: https://mybb.com/versions/1.8.26/ Version: 1.8.26 Tested on: Ubuntu 20.04 Stored XSS 1: To reproduce do the following: 1. Login as administrator user 2. Browse to "Templates and Style...
CVE-2022-47170
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin = 1.5.48 versions...
Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting
All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup...
PT-2023-21860 · Gocd · Gocd
Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 23.1.0 Description: The issue is a stored XSS vulnerability, where pipeline configuration with a malicious pipeline label configuration can affect browser display of pipeline runs generated from that configuration. An...
CVE-2023-28335
The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...
UBUNTU-CVE-2023-28335
The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...
PT-2023-21658 · Moodle +6 · Moodle +1
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue is related to a link used to reset all templates of a database activity, which did not include the necessary token to prevent a CSRF risk. This could potentially allow...
CVE-2023-28335 Moodle: csrf risk in resetting all templates of a database activity
The link to reset all templates of a database activity did not include the necessary token to prevent a CSRF risk...
CVE-2023-27638
creationtimestamp| type| source ---|---|--- 2023-03-22 15:35:55+00:00| exploited| https://t.me/cibsecurity/60443 2025-05-29 13:34:47+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2023/CVE-2023-27638.yaml 2025-05-31 21:02:20+00:00| seen|...
