Concrete CMS: Remote Code Execution (Reverse Shell) - File Manager

Remote Code Execution Reverse Shell - File Manager • Title: concrete5-8.5.2 Remote Code Execution - Reverse Shell • Keyword: crayons • Software : concrete5 • Product Version: 8.5.2 • Vulnerability : Remote Code Execution - Reverse Shell • Vulnerable component: File Manager The attacker needs the...

PT-2019-18215 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: F5 BIG-IP versions 11.5.1 through 11.6.4 F5 BIG-IP versions 12.1.0 through 12.1.4.1 F5 BIG-IP versions 13.0.0 through 13.1.1.4 F5 BIG-IP versions 14.0.0 through 14.0.0.4 F5 BIG-IP versions 14.1.0 through 14.1.0.5 Description: The issue allows...

Design/Logic Flaw

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...

CVE-2019-0213

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...

CVE-2019-0213: Improper Neutralization of Input During Web Page Generation

In Apache Archiva before 2.2.4, it may be possible to store malicious XSS code into central configuration entries, i.e. the logo URL. The vulnerability is considered as minor risk, as only users with admin role can change the configuration, or the communication between the browser and the Archiva...

CVE-2019-10888

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html...

CVE-2019-10888: Cross-Site Request Forgery (CSRF)

A CSRF Issue that can add an admin user was discovered in UKcms v1.1.10 via admin.php/admin/role/add.html...

PT-2019-12080

Name of the Vulnerable Software and Affected Versions UKcms version 1.1.10 Description A CSRF issue was discovered that can add an admin user. The issue is related to the "admin.php/admin/role/add.html" API endpoint. Recommendations For UKcms version 1.1.10, update to a newer version that contain...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

Cross site request forgery (csrf)

YzmCMS v5.2 has admin/role/add.html CSRF...

CVE-2018-20015

YzmCMS v5.2 has admin/role/add.html CSRF...

PT-2018-15237

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description The issue affects the admin/role/add.html endpoint, where a CSRF vulnerability is present. Recommendations For YzmCMS version 5.2, consider implementing CSRF protection measures, such as token-based validation, t...

CVE-2018-20015: Cross-Site Request Forgery (CSRF)

YzmCMS v5.2 has admin/role/add.html CSRF...

Cross site request forgery (csrf)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

PT-2018-14990

Name of the Vulnerable Software and Affected Versions JEECMS version 9.3 Description The issue allows for CSRF via the "api/admin/role/save" API endpoint to add a user. Recommendations For JEECMS version 9.3, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions...

CVE-2018-19545: Cross-Site Request Forgery (CSRF)

JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user...

springboot_authority cross-site scripting vulnerability

springbootauthority is a backend management system. The system includes modules for user management, role management, and resource connection management. A cross-site scripting vulnerability exists in the admin/role/edit page in springbootauthority 2017-03-06 and earlier versions, which can be...

CVE-2018-17369

An issue was discovered in springbootauthority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter...

Cross site scripting

An issue was discovered in springbootauthority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey, name, or description parameter...

CVE-2018-17369

CVE-2018-17369 affects the SpringBoot Authority project up to 2017-03-06, with a stored XSS vulnerability on the admin/role/edit page through the parameters roleKey, name, or description. The issue is documented across multiple sources (NVD, CNVD, CVE records) and is described as input-based stor...