CVE-2018-18763: Improper Neutralization of Special Elements used in an SQL Command

SaltOS 3.1 r8126 allows action=ajax&query=numbers&page=usuarios&action2=SQL SQL Injection...

PT-2018-14635

Name of the Vulnerable Software and Affected Versions SaltOS version 3.1 r8126 Description The issue allows for SQL Injection via the action2 parameter in the action=ajax&query=numbers&page=usuarios endpoint. This can be exploited by injecting malicious SQL code into the action2 parameter, marked...

CVE-2011-4361: Incorrect Default Permissions

MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by 1 leveraging the SpecialUpload::ajaxGetExistsWarning function, or by 2 leveraging an extension, as demonstrated by the CategoryTree,...