11970 matches found
MAL-2022-5948 Malicious code in sc-add-to-cart (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5257c8252b296dd5d8b693935047369934e120b7e0c18c6497b922fb174455c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2017-20064
A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version 1.3.13 is able to...
Directory Management System SQL Injection Vulnerability
Directory Management System is a directory management system. A SQL injection vulnerability exists in Directory Management System v1.0, which stems from a lack of validation of the fullname parameter in add-directory.php against an externally-entered SQL statement. An attacker can exploit this...
Privilege Escalation via edit response body
Description Recently, i found a business logic vulnerabity and this vulnerability allow reader user perform privilege escalation on allaccess user. Because before user perform any function, client-side will perform OPTIONS request to view user permission with specify function via response body. I...
GHSA-9RG7-3J4F-CF4X QueryInterface should call AddRef before returning pointer
Affected version of this crate, which is a required dependency in com-impl, provides a faulty implementation of the IUnknown::QueryInterface method. QueryInterface implementation must call IUnknown::AddRef before returning the pointer, as describe in this documentation: As it is not incrementing...
CVE-2022-26173
JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery CSRF via http://targethost:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts...
CVE-2022-31384
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php...
CVE-2022-31384
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php...
CVE-2022-31384
Directory Management System v1.0 was discovered to contain a SQL injection vulnerability via the fullname parameter in add-directory.php...
CVE-2022-31384
CVE-2022-31384 affects Directory Management System v1.0, with a SQL injection vulnerability in add-directory.php exploitable via the fullname parameter due to insufficient input validation. Affected component is the add-directory.php endpoint; the issue enables arbitrary SQL execution and potenti...
PT-2022-3051
Name of the Vulnerable Software and Affected Versions Directory Management System version 1.0 Description The issue is related to a SQL injection vulnerability in the add-directory.php component of the Directory Management System. This vulnerability can be exploited by a remote attacker to execut...
Directory Management System SQL注入漏洞
Directory Management System is a directory management system. A SQL injection vulnerability exists in Directory Management System v1.0, which stems from a lack of validation of the fullname parameter in add-directory.php against an externally-entered SQL statement. An attacker can exploit this...
Webmin <= 1.994 Multiple Vulnerabilities
Webmin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webmin:webmin"; ifdescription...
JForum 跨站请求伪造漏洞
JForum is Jforum team of a set of Java language development , Web-based open source forum system . JForum v2.8.0 version of a security vulnerability , the vulnerability stems from /jforum.page found to exist cross-site request forgery vulnerability . Attackers use this vulnerability to arbitraril...
CMS Made Simple <= 2.2.15 XSS Vulnerability
CMS Made Simple is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2019-25070 WolfCMS User Add cross site scripting
UNSUPPORTED WHEN ASSIGNED A vulnerability was found in WolfCMS up to 0.8.3.1. It has been rated as problematic. This issue affects some unknown processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the argument name leads to basic cross site scripting. Th...
CVE-2019-25070
CVE-2019-25070 affects WolfCMS up to version 0.8.3.1 in the User Add path (/wolfcms/?/admin/user/add). The vulnerability arises from improper handling of the name parameter, enabling basic cross-site scripting (XSS). Exploitation can be remote and public disclosures exist. Several connected sourc...
CVE-2022-30925
H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /goform/aspForm...