6710 matches found
CVE-2019-8130: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates...
CVE-2019-8110: Undefined Security Weakness
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage email templates hierarchy to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code...
CVE-2019-8143: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to email templates can send malicious SQL queries and obtain access to sensitive information stored in the database...
Cross-Site Scripting (XSS)
bodhi-server is vulnerable to cross-site scripting XSS. A remote attacker with create/edit updates privileges is able to inject arbitrary Javascript into a victim's browser via multiple parameters in the templates such as the beautifytitle, displayname and requirements...
Apache Solr Remote Command Execution Vulnerability Based on Velocity Templates
Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. A remote command execution vulnerability exists in Apache Solr based o...
Email Templates < 1.3.1 - HTML Injection
The Email Templates WordPress plugin was affected by a HTML Injection security vulnerability...
CVE-2015-9499
creationtimestamp| type| source ---|---|--- 2019-10-23 00:27:26+00:00| seen| https://t.me/cibsecurity/7569 2019-10-28 15:46:25+00:00| seen| https://t.me/cibsecurity/7692 2025-06-12 11:30:37+00:00| confirmed|...
Etherpad-Lite Cross-Site Scripting Vulnerability
Etherpad-Lite is a Web-based open source document editor from the Etherpad Foundation. A cross-site scripting vulnerability exists in the templates/pad.html page in Etherpad-Lite version 1.7.5, which stems from a lack of proper validation of client-side data in the WEB application and can be...
CVE-2019-18209
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
CVE-2019-18209
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
Default credentials
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
CVE-2019-18209
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
CVE-2019-18209: Improper Neutralization of Input During Web Page Generation
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer...
PT-2019-15277
Name of the Vulnerable Software and Affected Versions Etherpad-Lite version 1.7.5 Description The issue arises in the templates/pad.html file of Etherpad-Lite when the browser does not properly encode the path of the URL, leading to a cross-site scripting XSS vulnerability. This has been...
Adobe Acrobat Pro DC XFA Form Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processin...
Adobe Acrobat Reader DC XFA template Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...
Adobe Acrobat Reader DC XFA Form Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
PRODSECBUG-2489: Cross side scripting during the preview of email templates
More info at https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update...