CVE-2023-48060

Dreamer CMS v4.1.3 contains a Cross-Site Request Forgery (CSRF) in the component "/admin/task/add". The root cause is a CSRF flaw that can enable unauthorized actions on behalf of a user; CVSSv3.1: 8.8 (HIGH) with network attack vector, low attack complexity, no privileges, user interaction requi...

CVE-2023-48058: Cross-Site Request Forgery (CSRF)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/task/run...

CVE-2023-48060: Cross-Site Request Forgery (CSRF)

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/task/add...

PT-2023-30687 · Unknown · Dreamer Cms

Name of the Vulnerable Software and Affected Versions: Dreamer CMS version 4.1.3 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /admin/task/run component. This allows for unauthorized actions to be performed on behalf of an authenticated user. Recommendations: For...

Moodle reflected XSS Vulnerability

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

CVE-2020-14320

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

CVE-2020-14320

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

Cross site scripting

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

UBUNTU-CVE-2020-14320

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

CVE-2020-14320

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

CVE-2020-14320

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

CVE-2020-14320: Improper Neutralization of Input During Web Page Generation

In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...

PT-2022-8562 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.9.1 Moodle versions prior to 3.8.4 Moodle versions prior to 3.7.7 Description: The issue is related to a reflected XSS risk in the admin task log filter. This suggests a potential for malicious script execution due ...

MyBB Group MyBB File Inclusion Vulnerability

MyBB aka MyBulletinBoard is a free and web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. MyBB Group A file inclusion vulnerability exists in the Admin panel Tools and Maintenance - Task...

CVE-2014-3070

The addFileRegistryAccount Virtual Member Manager VMM SPI Admin Task in IBM WebSphere Application Server WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors...

Design/Logic Flaw

The addFileRegistryAccount Virtual Member Manager VMM SPI Admin Task in IBM WebSphere Application Server WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2014-3070

The CVE-2014-3070 case affects IBM WebSphere Application Server where the addFileRegistryAccount (VMM SPI Admin Task) can bypass access restrictions due to improper account creation. Affected products/versions: WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3. IBM bulletins document remediation...

CVE-2014-3070: Undefined Security Weakness

The addFileRegistryAccount Virtual Member Manager VMM SPI Admin Task in IBM WebSphere Application Server WAS 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors...