4722 matches found
CVE-2022-24251
Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function...
PT-2022-16827 · Unknown · Fluture-Node
Name of the Vulnerable Software and Affected Versions: Fluture-Node versions 4.0.0 through 4.0.1 Description: Using followRedirects or followRedirectsWith with any of the redirection strategies built into Fluture-Node, paired with a request that includes confidential headers such as Authorization...
CodeIgniter 跨站请求伪造漏洞
CodeIgniter is an open source web framework written in PHP. A cross-site request forgery vulnerability exists in CodeIgniter because the product does not validate user identity. The vulnerability can be exploited to send unintended requests to the server. The following products and versions are...
PT-2022-17702 · Unknown · Ametys Cms
Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The auto-completion plugin in Ametys CMS allows a remote unauthenticated attacker to read documents, which contain all characters typed by all users, including the content of private pages. Thes...
Ametys Cms 信息泄露漏洞
Ametys Cms is used to run large enterprise websites, blogs, Intranet and Extranet on the same server.Ametys Community Cms a free open source content management system written in Java. An information disclosure vulnerability exists in the Ametys CMS auto-completion plugins, which originated in the...
CVE-2021-43943
Affected versions of Atlassian Jira Service Management Server and Data Center allow attackers with administrator privileges to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the "Object Schema" field of /secure/admin/InsightDefaultCustomFieldConfig.jspa. The...
CVE-2022-24226
Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php...
PT-2022-2744 · Unknown · Hospital Management System
Name of the Vulnerable Software and Affected Versions: Hospital Management System version 4.0 Description: The issue is related to a blind SQL injection vulnerability in the register function of the Hospital Management System, specifically via the func2.php file. This vulnerability can be exploit...
CVE-2022-23389
PublicCMS v4.0 was discovered to contain a remote code execution RCE vulnerability via the cmdarray parameter...
CVE-2022-23389
PublicCMS v4.0 was discovered to contain a remote code execution RCE vulnerability via the cmdarray parameter...
PHPGurukul Hospital Management System SQL注入漏洞
PHPGurukul Hospital Management System is a PHP and MySQL based hospital management system. A security vulnerability exists in Hospital Management System v4.0, which originates from a SQL injection vulnerability found in Hospital-Management-System-master contact.php via the txtMsg parameter...
PT-2022-6694 · Schneider Electric · Ecostruxure Ev Charging Expert
Name of the Vulnerable Software and Affected Versions: EcoStruxure EV Charging Expert versions prior to V4.0.0.13 Description: A vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within...
jpress 安全漏洞
Jpress is a blogging platform developed by the Jpress team using the Java language. A security vulnerability exists in jpress, which stems from a Remote Code Execution RCE vulnerability in HelloWorldAddonController.java in jpress v4.2.0 that allows an attacker to execute arbitrary code via a...
PYSEC-2022-19
The % debug % template tag in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS...
CVE-2022-24263
Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter...
UBUNTU-CVE-2021-46088
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution RCE. Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user...
CVE-2021-44122
SPIP 4.0.0 is affected by a Cross Site Request Forgery CSRF vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to...
CVE-2021-44120
SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site...
DEBIAN-CVE-2021-44122
SPIP 4.0.0 is affected by a Cross Site Request Forgery CSRF vulnerability in ecrire/public/aiguiller.php, ecrire/public/balises.php, ecrire/balise/formulaire.php. To exploit the vulnerability, a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to...