3093 matches found
JVN#97370614: MagazinegerZ vulnerable to cross-site scripting
MagazinegerZ provided by CGI Script Market is a CGI script which provides a function to enable email newsletter distribution for a website. MagazinegerZ contains a stored cross-site scripting vulnerability CWE-79 which allows unintentional script execution on the web browser of the administrative...
PT-2021-18032
Name of the Vulnerable Software and Affected Versions: Bitweaver version 3.1.0 Description: A cross-site scripting XSS issue allows remote attackers to inject JavaScript via the "users/admin/user activity.php" API endpoint. This enables attackers to execute malicious scripts on the client-side...
CVE-2021-24132
The Slider by 10Web WordPress plugin, versions before 1.2.36, in the bulkaction, exportfull and savesliderdb functionalities of the plugin were vulnerable, allowing a high privileged user Admin, or medium one such as Contributor+ if "Role Options" is turn on for other users to perform a SQL...
PT-2021-15670
Name of the Vulnerable Software and Affected Versions: Contact Form Submissions WordPress plugin versions 1.6.4 and earlier Contact Form Submissions WordPress plugin versions prior to 1.7.1 Description: The issue arises from unvalidated input in the Contact Form Submissions WordPress plugin, whic...
CVE-2021-24125: Improper Neutralization of Special Elements used in an SQL Command
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7contactform GET parameter when submitting a filter request as a high privilege user admin+...
CVE-2021-24130: Improper Neutralization of Special Elements used in an SQL Command
Unvalidated input in the WP Google Map Plugin WordPress plugin, versions before 4.1.5, in the Manage Locations page within the plugin settings was vulnerable to SQL Injection through a high privileged user admin+...
PT-2021-11022
Name of the Vulnerable Software and Affected Versions: Portainer versions 1.24.1 and earlier Description: The issue is related to insecure permissions, potentially leading to remote arbitrary code execution. A non-admin user can spawn new containers with critical capabilities, such as SYS MODULE,...
Cross site request forgery (csrf)
An issue was discovered in Quadbase EspressReports ES 7 Update 9. It allows CSRF, whereby an attacker may be able to trick an authenticated admin level user into uploading malicious files to the web server...
OpenCMS 11.0.2 Cross Site Request Forgery / Open Redirection Vulnerability
OpenCMS v11.0.2 -------------------------------------------------------------------------------------------------------------------------------------------------- CSRF - Login page vulnerable https://vulnerablehost.com/system/login - CSRF needs valid JSESSIONID to work, maybe logged Admin user...
OpenCMS 11.0.2 Cross Site Request Forgery / Open Redirection
OpenCMS v11.0.2 -------------------------------------------------------------------------------------------------------------------------------------------------- CSRF - Login page vulnerable https://vulnerablehost.com/system/login - CSRF needs valid JSESSIONID to work, maybe logged Admin user...
CVE-2021-3273
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system...
Code injection
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system...
CVE-2021-3273
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system...
CVE-2021-3273
CVE-2021-3273 affects Nagios XI below 5.7. A code injection flaw exists in the /nagiosxi/admin/graphtemplates.php component due to insufficient input filtering. Exploitation requires an admin web UI account. The vulnerability impact is code execution with high severity; details across connected s...
PT-2021-19890
Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.7 Description The issue affects the /nagiosxi/admin/graphtemplates.php component, where code injection is possible. To exploit this, an attacker must have an admin user account in Nagios XI's web system...
CVE-2021-3273: Improper Control of Generation of Code
Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someone must have an admin user account in Nagios XI's web system...
Design/Logic Flaw
ownCloud Server before 10.3.0 allows an attacker, who has received non-administrative access to a group share, to remove everyone else's access to that share...
Sysinternals PsExec Elevation of Privilege (CVE-2021-1733)
An elevation of privilege vulnerability exists in Sysinternals PsExec due to the application not properly imposing security restrictions in PsExec, which leads to a security restrictions bypass and privilege escalation. It is possible for a local attacker who is authenticated as a non-admin user ...