PT-2021-21895 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.0 and earlier Description: The issue arises from insufficient validation of parameters during post creation, allowing authenticated attackers to cause a client-side crash of the web application via a maliciously crafted...

CVE-2021-41261

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been...

CVE-2021-41261

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been...

Cross site scripting

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been...

Ransom DDoS Enters its Fourth Wave

Extortionists target industries with most to lose from an outage Cybercriminals continue to target organizations threatening Denial of Service DDoS attacks in exchange for a ransom payment, traditionally demanded in bitcoin BTC. And it seems that no matter how many times these ransom threat cycle...

CVE-2021-41260

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue...

CVE-2021-41260

Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue...

CVE-2021-41261

CVE-2021-41261 affects Galette prior to version 0.9.6, where a stored cross-site scripting vulnerability exists in the preferences footer that can be modified by a site admin. The issue has been fixed in 0.9.6; upgrade all installations to that release. The public sources confirm the vulnerabilit...

CVE-2021-41260

CVE-2021-41260 affects Galette, a PHP-based membership management app. The issue is missing Cross-Site Request Forgery (CSRF) protections in versions prior to 0.9.6. Public disclosures from multiple sources (NVD, Red Hat, Ubuntu, CNVD, OSV) all state no CSRF checks exist before 0.9.6 and recommen...

CVE-2021-36450

Verint Workforce Optimization WFO 15.2.8.10048 allows XSS via the control/mynotifications NEWUINAV parameter...

Online Magazine Management System SQL注入漏洞

Online Magazine Management System is an open source PHP-based web application where users can share their magazines. Online Magazine Management System is vulnerable to SQL injection, which can be exploited by attackers to gain access to the application as an administrator...

cWifi Hotspot Wireless CP - Code Execution Vulnerability

Document Title: =============== cWifi Hotspot Wireless CP - Code Execution Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2310 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

OpenEMR 6.0.0 / 6.1.0-dev SQL Injection

Trovent Security Advisory 2109-01 Authenticated SQL injection in OpenEMR calendar search Overview Advisory ID: TRSA-2109-01 Advisory version: 1.0 Advisory status: Public Advisory URL: https://trovent.io/security-advisory-2109-01 Affected product: OpenEMR web application Tested versions: 6.0.0,...

OpenEMR 6.0.0 / 6.1.0-dev SQL Injection Vulnerability

OpenEMR versions 6.0.0 and 6.1.0-dev suffer from an authenticated remote SQL injection vulnerability in the calendar search functionality. Authenticated SQL injection in OpenEMR calendar search Overview Advisory version: 1.0 Advisory status: Public Advisory URL:...

uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities

Document Title: =============== uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2288 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...

Teamcenter Active Workspace Path Traversal Vulnerability

Teamcenter Active Workspace is a web application for accessing the Teamcenter system. Teamcenter Active Workspace path traversal vulnerability, where the application contains an insecure decompression mode, could lead to a compressed path traversal attack. An attacker could use this vulnerability...

jetty: Symlink directory exposes webapp directory contents

If the $jetty.base directory or the $jetty.base/webapps directory is a symlink the contents of the $jetty.base/webapps directory may be deployed as a static web application, exposing the content of the directory for download. The highest threat from this vulnerability is to data confidentiality...

Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

CVE-2021-44165

A vulnerability has been identified in POWER METER SICAM Q100 All versions V2.41, POWER METER SICAM Q100 All versions V2.41, POWER METER SICAM Q100 All versions V2.41, POWER METER SICAM Q100 All versions V2.41. The affected firmware contains a buffer overflow vulnerability in the web application...

Fortinet FortiWeb Buffer Overflow Vulnerability (CNVD-2021-101134)

Fortinet FortiWeb is a Web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures Web applications and protects sensitive database content. Versions 6.4.1 and 6.4.0 contain a buffer...