Security Bulletin: IBM API Connect is impacted by insecure web server configuration (CVE-2020-4825)

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2020-4825 DESCRIPTION: IBM API Connect is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali...

IBM MQ 7.5 / 8.0 / 9.0 < 9.0.0.11 LTS / 9.1 < 9.1.0.7 LTS / 9.2 < 9.2.0.1 LTS / 9.2 < 9.2.1 CD (6408626)

The version of IBM MQ Server running on the remote host is affected by a vulnerability. IBM MQ 7.5, 8.0, 9.0, 9.1, 9.2 LTS, and 9.2 CD could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization of trusted data. An attacker could exploit this...

CVE-2021-23271

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX:...

CVE-2021-23271

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX:...

Cross site scripting

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX:...

CVE-2021-23271

The CVE-2021-23271 entry concerns TIBCO EBX Web Server (TIBCO EBX) with a Stored Cross Site Scripting (XSS) vulnerability. Affected are TIBCO EBX versions 5.9.12 and earlier. The issue can be triggered by a low-privileged attacker with network access to execute XSS on the target system. The provi...

CVE-2021-23271 TIBCO EBX Cross Site Scripting (XSS)

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX:...

CVE-2021-23271

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX:...

Student Record System 4.0 SQL Injection

Exploit Title: Student Record System 4.0 - 'sid' SQL Injection Google Dork: N/A Date: 2/2/2021 Exploit Author: Jannick Tiger Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/wp-content/uploads/2019/05/schoolmanagement.zip Version: V 4.0 Tested on: Windows、XAMPP...

CVE-2021-23271: Improper Neutralization of Input During Web Page Generation

The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX:...

Tibco Ebx Cross-Site Scripting Vulnerability

Tibco Ebx is a software from Tibco India that supports integration to manage enterprise data assets. A cross-site scripting vulnerability exists in TIBCO EBX Web Server, which originated from a vulnerability that allows a low-privileged attacker with network access privileges to perform a stored...

PT-2021-15424

Name of the Vulnerable Software and Affected Versions TIBCO EBX versions 5.9.12 and below Description The TIBCO EBX Web Server component contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting XSS attack on the...

Oracle iPlanet web server Image Injection

The vulnerability of Oracle iPlanet web servers exists due to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to inject images into the administration console through the productNameSrc parameter in the URI admingui...

Oracle BI Publisher Web Server Unauthorized Access

The vulnerability of the Web Server component of the Oracle BI Publisher software for creating reports is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information, or to read, modify, add, or delete data...

Oracle iPlanet web server Key Disclosure

The vulnerability of Oracle iPlanet web server relates to the read-only access to encryption keys without authentication. Exploiting this vulnerability could allow a malicious actor to disclose the protected information remotely...

Student Record System 4.0 - 'cid' SQL Injection

Exploit Title: Student Record System 4.0 - 'cid' SQL Injection Date: 2/2/2021 Exploit Author: Jannick Tiger Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/wp-content/uploads/2019/05/schoolmanagement.zip Version: V 4.0 Tested on: Windows、XAMPP Identify the...

CVE-2020-36109

ASUS RT-AX86U router firmware below version under 9.0.0.4386 has a buffer overflow in the blockingrequest.cgi function of the httpd module that can cause code execution when an attacker constructs malicious data...

Shenzhen good business network studio Hsycms file upload vulnerability

Hsycms is an enterprise-level web content management system, written by PHP+MYSQL, using template separation technology to support the creation of many types of sites. Shenzhen Good Business Network Studio Hsycms has a file upload vulnerability that can be exploited by attackers to gain control o...

Command execution vulnerability in songcms backend (CNVD-2021-12674)

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. A command execution vulnerability exists in the backend of songcms. An attacker can...

Command Execution Vulnerability in songcms Backend

SongCMS is a PHP MySQL, ASP Access/SQL Server based development, enterprise-oriented, multi-language support, free, open source CMS to help business users to quickly build and deploy enterprise-level portals. A command execution vulnerability exists in the backend of songcms. An attacker can...