CVE-2016-15012 forcedotcom SalesforceMobileSDK-Windows QuerySpec.cs ComputeCountSql sql injection

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in forcedotcom SalesforceMobileSDK-Windows up to 4.x. It has been rated as critical. This issue affects the function ComputeCountSql of the file SalesforceSDK/SmartStore/Store/QuerySpec.cs. The manipulation leads to sql injection. Upgrading to...

Sql injection

A vulnerability was found in roxlukas LMeve up to 0.1.58. It has been rated as critical. Affected by this issue is the function insertlog of the file wwwroot/ccpwgl/proxy.php. The manipulation of the argument fetch leads to sql injection. Upgrading to version 0.1.59-beta is able to address this...

CVE-2020-36644 jamesmartin Inline SVG URL Parameter helpers.rb cross site scripting

A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file lib/inlinesvg/actionview/helpers.rb of the component URL Parameter Handler. The manipulation of the argument filename leads to...

CVE-2020-36642 trampgeek jobe LanguageTask.php run_in_sandbox command injection

A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function runinsandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The identifie...

PT-2023-15893 · Unknown · Forged Alliance Forever

Name of the Vulnerable Software and Affected Versions: Forged Alliance Forever versions up to 3746 Description: A critical issue was found in the Vote Handler component, leading to improper authorization due to manipulation of an unknown functionality. Upgrading to version 3747 addresses this...

CVE-2022-46177

Discourse vulnerability CVE-2022-46177 affects Discourse versions prior to 2.8.14 (stable) and prior to 3.0.0.beta15 (beta/tests-passed). If a user requests a password-reset link and then changes the primary email, the old reset email can remain valid; using it to reset the password re-links the ...

Information Exposure

Overview pghero is a performance dashboard for Postgres. Affected versions of this package are vulnerable to Information Exposure via the explain functionality, due to improper validation of the user query, which might result in data leakage from the query error message. Remediation Upgrade pgher...

PYSEC-2023-19

A vulnerability, which was classified as problematic, was found in kakwa LdapCherry up to 0.x. Affected is an unknown function of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.0 is able to address...

PT-2023-12407 · Shannah · Xataface

Name of the Vulnerable Software and Affected Versions: shannah Xataface versions up to 2.x Description: A problematic issue has been found in the function testftp of the file install/install form.js.php of the component Installer, leading to cross site scripting. The attack may be launched...

PT-2023-15891 · Snoyberg · Keter

Name of the Vulnerable Software and Affected Versions: snoyberg keter versions up to 1.8.1 Description: A vulnerability has been found in snoyberg keter, classified as problematic. This issue affects unknown code of the file Keter/Proxy.hs. The manipulation of the argument host leads to cross-sit...

Cross site scripting

A vulnerability was found in slackero phpwcms up to 1.9.26. It has been classified as problematic. This affects an unknown part of the component SVG File Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.9.27 is able to...

CVE-2021-4297 trampgeek jobe Restapi.php runs_post Privilege Escalation

A vulnerability has been found in trampgeek jobe up to 1.6.4 and classified as problematic. This vulnerability affects the function runspost of the file application/controllers/Restapi.php. The manipulation of the argument sourcefilename leads to an unknown weakness. Upgrading to version 1.6.5 is...

PT-2022-28120 · Mellium · Mellium.Im/Sasl

Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/sasl versions prior to 0.3.1 Description: An issue was discovered in Mellium mellium.im/sasl when performing SCRAM-based SASL authentication. If the remote end advertises support for channel binding, no random nonce is...

PT-2022-8022 · Unknown · Ariadne Component Library

Name of the Vulnerable Software and Affected Versions: Ariadne Component Library versions up to 2.x Description: A critical issue has been found, affecting an unknown function of the file src/url/Url.php. This issue leads to server-side request forgery. Recommendations: For Ariadne Component...

GHSA-9P62-X3C5-HR5P Path Traversal In MeterSpere leads to upload file to any path

Summary MeterSphere allow users to upload file, but not check the file name, may lead to upload file to any path if the file name in upload request is falsified. Details Metersphere's FileUtils.java didn't check the filePath. java public static void createFileString filePath, byte fileBytes File...

Path Traversal In MeterSpere leads to upload file to any path

Summary MeterSphere allow users to upload file, but not check the file name, may lead to upload file to any path if the file name in upload request is falsified. Details Metersphere's FileUtils.java didn't check the filePath. java public static void createFileString filePath, byte fileBytes File...

OESA-2022-2166 trafficserver security update

Apache Traffic Server is an OpenSource HTTP / HTTPS / HTTP/2 / QUIC reverse,forward and transparent proxy and cache. Security Fixes: Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain...

CVE-2020-36635 OpenMRS Appointment Scheduling Module AppointmentTypeValidator.java validateFieldName cross site scripting

A vulnerability was found in OpenMRS Appointment Scheduling Module up to 1.12.x. It has been classified as problematic. This affects the function validateFieldName of the file api/src/main/java/org/openmrs/module/appointmentscheduling/validator/AppointmentTypeValidator.java. The manipulation lead...

UBUNTU-CVE-2021-4286

A vulnerability, which was classified as problematic, has been found in cocagne pysrp up to 1.0.16. This issue affects the function calculatex of the file srp/ctsrp.py. The manipulation leads to information exposure through discrepancy. Upgrading to version 1.0.17 is able to address this issue. T...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies. PoC javascript const ...