Carlo Gavazzi UWP 访问控制错误漏洞

Carlo Gavazzi UWP is a monitoring and control Universal Web Platform from Carlo Gavazzi. for applications such as building automation, energy efficiency performance management, and parking lot guidance. Carlo Gavazzi UWP 3.0 suffers from an Access Control Error vulnerability that stems from a lac...

CVE-2022-25046

A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request...

MAL-2022-620 Malicious code in @ta-web-platform/localezone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 007f35ba53a5e20c06b04deb9443ba80f71bbccf8962ae4d064ff6e93dfb967b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Silverstripe CMS malicious file upload enables script execution

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions for example HTML code in a TXT file. When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Upload...

MODX Revolution 代码问题漏洞

MODX Revolution is a PHP-based open source content management system CMS from the US company MODX. The system supports online collaboration, search engine optimization SEO, etc. MODX Revolution has a code issue vulnerability that can be exploited by attackers to execute arbitrary code by uploadin...

The vulnerability of the web page rendering modules in WebKitGTK and WPE for Apple operating systems such as iPadOS, watchOS, iOS, tvOS, as well as in browsers like Safari, multimedia player iTunes, and iCloud service for Windows operating systems, allows attackers to execute cross-site scripting attacks.

The vulnerability of the web page rendering modules in WebKitGTK and WPE for Apple operating systems such as iPadOS, watchOS, iOS, tvOS, the Safari browser, the multimedia player iTunes, and the iCloud service for Windows operating systems is related to the lack of measures taken to protect the...

Hitachi Energy LinkOne 信息泄露漏洞

Hitachi Energy LinkOne is an enterprise graphical parts catalog and content delivery solution from Hitachi Energy, Switzerland. It is used to publish, view and locate spare parts for complex equipment and assemblies. A security vulnerability exists in Hitachi Energy LinkOne, which arises from a...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

TIBCO Partnerexpress 跨站脚本漏洞

TIBCO Partnerexpress is a Php-based platform for generating barcodes from product names from TIBCO Corporation. A cross-site scripting vulnerability exists in Tibco PartnerExpress, which originates from the product not validating user input data. The vulnerability can be exploited to execute...

vaadin 跨站脚本漏洞

vaadin vaadin is an open source platform for web application development from Finnish company vaadin. the vaadin platform consists of a set of web components, a Java web framework, and a set of tools and application launchers. the vaadin platform includes a set of web components, a Java web...

BookStack 代码问题漏洞

BookStack is an open source platform for building wiki documentation using PHP and Laravel from the BookStackApp Bookstackapp team. Bookstack has a code issue vulnerability that arises from improper design or implementation during code development of a web-based system or product...

Wire 代码问题漏洞

Wire is a chat software by an individual developer. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original greeting method, PING. Wire suffers from a security vulnerability. An attacker can pass a malicious payloa...

Design/Logic Flaw

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the...

CVE-2021-29440

Grav CMS 1.7.x is affected by CVE-2021-29440 due to unsandboxed Twig processing of static pages enabled via front matter by users with page-creation/admin privileges. The vulnerability enables server-side template injection, which can lead to arbitrary code execution and privilege escalation on t...

Viki Solutions Viki Vera 跨站脚本漏洞

Viki Solutions Viki Vera is a suite of workflow customization platforms from Canadian company Viki Solutions. The platform supports file uploading, job management, and other features. A security vulnerability exists in Viki Vera 4.9.1.26180, which can be exploited by an attacker to set a user's...

SQL Injection Vulnerability in OneKey Education Cloud Disk Service Platform of Orient Boguan (Beijing) Technology Co.

The OneKey Education Cloud Disk Service Platform supports multiple platforms such as Web, PC, and Android cell phone clients for cross-platform and cross-terminal file sharing and anytime, anywhere access. There is a SQL injection vulnerability in the OneKey Education Cloud Disk Service Platform ...

CVE-2020-9309

SilverStripe CMS up to version 4.5 is vulnerable to script execution via malicious upload contents, when files with allowed extensions are stored as protected or draft and MIME detection causes browsers to run the file contents. Affected component/file: uploads handling (protected/draft state) an...

CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...