Path Traversal in JSON Plugin in Grafana

Grafana is an open-source platform for monitoring and observability. The JSON datasource plugin is a Grafana Labs maintained plugin that allows for retrieving and processing JSON data from a remote endpoint including a specific sub-path configured by an administrator. Due to inadequate sanitizati...

PT-2023-20617 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 2023.5 and earlier Adobe ColdFusion versions 2021.11 and earlier Description: The issue is related to an Improper Access Control that could result in a Security feature bypass. An unauthenticated attacker could...

PT-2023-3959 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 2018u18 and earlier Adobe ColdFusion versions 2021u8 and earlier Adobe ColdFusion versions 2023u2 and earlier Description: The issue is related to improper access control in the ColdFusion platform, which could allow...

PT-2023-3961 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: Adobe ColdFusion versions 2018u18 and earlier, 2021u8 and earlier and 2023u2 and earlier Description: The issue is related to an improper access control vulnerability that could result in a security feature bypass. An attacker could leverage...

CVE-2023-29298

Adobe ColdFusion versions 2018u16 and earlier, 2021u6 and earlier and 2023.0.0.330468 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC...

PT-2023-3962

Name of the Vulnerable Software and Affected Versions Adobe ColdFusion versions 2018u16 and earlier Adobe ColdFusion versions 2021u6 and earlier Adobe ColdFusion versions 2023.0.0.330468 and earlier Description The issue is related to an Improper Access Control vulnerability that could result in ...

PT-2023-22824 · Jellyfin · Jellyfin-Web

Name of the Vulnerable Software and Affected Versions: jellyfin-web versions 10.1.0 through 10.8.10 Description: A stored cross-site scripting issue in device.js can be used to make arbitrary calls to the REST endpoints with admin privileges. This can result in remote code execution on the Jellyf...

CVE-2023-26120

This affects all versions of the package com.xuxueli:xxl-job. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update...

PT-2023-12277 · Adminlte · Adminlte

Name of the Vulnerable Software and Affected Versions: AdminLTE version 3.1.0 Description: The issue allows remote attackers to gain escalated privilege and view sensitive information. This is achieved via the "/admin/index2.html" and "/admin/index3.html" API endpoints. The estimated number of...

Race Condition in Authentication in Grafana

Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentication middlewares logic which may allow an unauthenticated user to query an administration endpoint under heavy load. This issue is patche...

PT-2022-23255 · Unknown · Bus Pass Management System

Name of the Vulnerable Software and Affected Versions: Bus Pass Management System version 1.0 Description: Multiple SQL injections were detected in the Bus Pass Management System. The issue affects several API endpoints, including "buspassms/admin/view-enquiry.php",...

GHSA-R4V8-9HGX-VM6M Cloud Foundry UAA accepts refresh token as access token on admin endpoints

Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longe...

Cloud Foundry UAA accepts refresh token as access token on admin endpoints

Cloud Foundry UAA, versions 4.19 prior to 4.19.2 and 4.12 prior to 4.12.4 and 4.10 prior to 4.10.2 and 4.7 prior to 4.7.6 and 4.5 prior to 4.5.7, incorrectly authorizes requests to admin endpoints by accepting a valid refresh token in lieu of an access token. Refresh tokens by design have a longe...

Accellion FTA OS Command Injection Vulnerability

Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints...

VulnCheck KEV: CVE-2021-27104

Accellion FTA contains an OS command injection vulnerability exploited via a crafted POST request to various admin endpoints...

CVE-2020-28657

CVE-2020-28657 affects bPanel 2.0. The vulnerability is in the administrative ajax endpoints (ajax/aj_*.php), which are accessible without authentication and allow SQL injections, potentially enabling platform compromise. The issue is documented across multiple connected records (NVD entry and RH...

CVE-2021-27104

Accellion FTA 912370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA912380 and later...

CVE-2021-27104

Accellion FTA 912370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA912380 and later...

Command injection

Accellion FTA 912370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA912380 and later...

CVE-2021-27104

Accellion FTA 912370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA912380 and later. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...