11970 matches found
ThinkCMF Cross Site Request Forgerly (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability in ThinkCMF, which can add an admin account...
Gravity Forms stored HTML injection vulnerability
Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role...
OpenCart Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF in CART option in OpenCart Ltd. Opencart CMS 3.0.3.6 allows attacker to add cart items via Add to cart...
Microweber allows Unrestricted File Upload
Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/loadmodule:usersedit-user=1 does not verify that the file extension used with the Add Image option on the Edit User screen corresponds to an image file...
GHSA-RJJQ-63C7-8724 CSRF vulnerability in Jenkins P4 Plugin
A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce...
GHSA-F9V6-P7HP-C3QX Missing permission checks in Jenkins P4 Plugin
A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository. P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints...
CVE-2022-29206
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.SparseTensorDenseAdd does not fully validate the input arguments. In this case, a reference gets bound to a nullptr during kernel execution. This is...
Google TensorFlow代码问题漏洞
Google TensorFlow, an end-to-end open source platform for machine learning from Google, Inc. is vulnerable to a code issue in versions prior to 2.9.0, 2.8.1, 2.7.2, and 2.6.4, which stems from tf.rawops. SparseTensorDenseAdd has incomplete validation for the input parameters. No detailed...
OrangeHRM 跨站脚本漏洞
OrangeHRM is a human resource management system HRM from OrangeHRM USA. The system supports personnel information management, leave management, time and attendance management and recruitment management, etc. A cross-site scripting vulnerability exists in OrangeHRM v4.10.1, which stems from a lack...
PT-2022-3037 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.3 through 14.9.4 GitLab CE/EE versions 14.10 through 14.10.3 GitLab CE/EE versions 15.0 through 15.0.0 Description: An issue has been discovered in GitLab CE/EE, related to inadequate access control. It may be possibl...
Stored Cross Site Scripting on "Add user" field
Steps to reproduce: 1. Go to settings-- Access controls -- Add user 2. Payload = """ 3. Add XSS payload as username and create a new user 4. After creating the user, click on delete button and the XSS will be triggered POC Screenshot:...
Canvs Canvas Cross-site Scripting (XSS) via title and content fields
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...
GHSA-3657-Q433-MMPX Canvs Canvas Cross-site Scripting (XSS) via title and content fields
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...
Cobbler vulnerable to arbitrary code execution
Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user...
Gleez CMS Stored XSS
Cross-site scripting XSS vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers users to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode ...
GHSA-M2R2-QC49-GQW4 Gleez CMS Stored XSS
Cross-site scripting XSS vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers users to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode ...
Moodle Cross-site Scripting in the Course summary filter of the Add a new course
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element...
MantisBT Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in manageprojcatadd.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action...
GHSA-74X7-MFVG-H2WF MantisBT Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in manageprojcatadd.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action...