2942 matches found
GHSA-P64X-8RXX-WF6Q Django `Trunc()` and `Extract()` database functions vulnerable to SQL Injection
An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6. The Trunc and Extract database functions are subject to SQL injection if untrusted data is used as a kind/lookupname value. Applications that constrain the lookup name and kind choice to a known safe list are unaffected...
Newsletter SQL注入漏洞
Newsletter is a one-click bulk email solution. A security vulnerability exists in the Newsletter v3.x series of releases that stems from a security issue with the zemeznewsletteremail parameter...
WordPress plugin Import any XML or CSV File 代码问题漏洞
WordPress is a blogging platform developed using the PHP language. WordPress Import any XML or CSV File plugin versions prior to 3.6.8 are vulnerable to arbitrary file uploads, which originate from accepting all zip files and automatically extracting the zip file without validating the extracted...
HongCMS 安全漏洞
HongCMS is an open source lightweight content management system CMS. A security vulnerability exists in HongCMS v3.0, which stems from an issue in the /template/edit component that allows an attacker to obtain a shell...
CVE-2022-29097
Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application...
CVE-2022-33095
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist...
ASUS RT-N53 命令注入漏洞
ASUS RT-N53 is a driver application from Asus Taiwan, China. A security vulnerability exists in ASUS RT-N53 version 3.0.0.4.376.3754, which originates from a command injection in the SystemCmd parameter of the apply.cgi interface...
CVE-2022-31298
A cross-site scripting vulnerability in the ads comment section of Haraj v3.7 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request...
Haraj 跨站脚本漏洞
Haraj is a buying and selling platform from Haraj Saudi Arabia. A security vulnerability exists in Haraj version 3.7, which stems from a reflected cross-site scripting issue in the User Upgrade Form...
CVE-2022-32254
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker...
CVE-2022-31447
An XML external entity XXE injection vulnerability in Magicpin v3.4 allows attackers to access sensitive database information via a crafted SVG file...
PT-2022-20391 · Unknown · Tourism Management System
Name of the Vulnerable Software and Affected Versions: Tourism Management System version V 3.2 Description: The issue is related to Cross Site Request Forgery CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For Tourism...
PT-2022-20733 · Itop +1 · Itop +1
Name of the Vulnerable Software and Affected Versions: ITOP version 3.0.1 Description: A cross-site scripting XSS issue was found in ITOP. The vulnerability can be exploited via the "/itop/pages/ajax.render.php" API endpoint. Recommendations: For ITOP version 3.0.1, as a temporary workaround,...
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S) IMAP(S) POP3(S) and LDAP(S) (openldap only).
...
directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar
...
Barco Control Room 授权问题漏洞
Barco Control Room is a visualization and collaboration solution from Barco Belgium. It is used to build control rooms. A security vulnerability previously existed in the Barco Control Room Management Suite web application version 3.14, which stemmed from the ability to expose log files without...
Barco Control Room 跨站脚本漏洞
Barco Control Room is a visualization and collaboration solution from Barco Belgium. Used to build control rooms, a cross-site scripting vulnerability exists in Barco Control Room prior to version 3.14. The vulnerability stems from the osusername parameter of the /checklogin.jsp endpoint not bein...
CVE-2022-29721
74cmsSE v3.5.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /home/jobfairol/resumelist...
CVE-2021-42859
A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release...
