Authentication flaw

Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable...

CVE-2021-41810 Script injection in M-Files Admin

Script injection in M-Files Admin versions before 22.2.11051.0, allows executing stored script in admin tool. M-Files Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely...

CVE-2021-41810

The CVE-2021-41810 issue affects M-Files Server. An administrative tool can store configuration data that may contain a script, which can be executed by another vault administrator. The vulnerability requires vault admin level authentication and is not remotely exploitable per the primary descrip...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), aimmo (>=2.0.0 <=2.0.1) +71 more potentially affected by CVE-2022-28347 via django (>=3.2.0 <=3.2.12)

django PYPI version =3.2.0, =1.0.1a0, =2.0.0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =6.0.0, =6.0.0, =6.4.1 - coldfront =1.1.0 - common-framework =2021.4.1 - directory-validators =9.0.0 and more Source cves: CVE-2022-28347 Source advisory: OSV:GHSA-W24H-V9QH-8GXJ...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), aimmo (>=2.0.0 <=2.0.1) +71 more potentially affected by CVE-2022-28347 via django (>=3.2.0 <=3.2.12)

django PYPI version =3.2.0, =1.0.1a0, =2.0.0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =6.0.0, =6.0.0, =6.4.1 - coldfront =1.1.0 - common-framework =2021.4.1 - directory-validators =9.0.0 and more Source cves: CVE-2022-28347 Source advisory: OSV:PYSEC-2022-191...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), apis-ampel (=0.1.0) +57 more potentially affected by CVE-2022-22818 via django (>=3.2.0 <=3.2.11)

django PYPI version =3.2.0, =1.0.1a0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =0.0.1, =0.0.14 - django-blocklist =1.0.0 - django-brazilian-zipcode =0.1.0 - django-cachalot =2.4.0 and more Source cves: CVE-2022-22818 Source advisory: OSV:PYSEC-2022-19...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), apis-ampel (=0.1.0) +51 more potentially affected by CVE-2021-45116 via django (>=3.2.0 <=3.2.10)

django PYPI version =3.2.0, =1.0.1a0, =0.2.0, =22.0.0.dev21, =22.0.0.dev13, =22.0.0.dev29, =22.0.0.dev30 - autoreduce-utils =0.1.0 - common-framework =2021.4.1 - directory-validators =9.0.0 - django-admin-taggit-ui =0.1.0.dev0 - django-blocklist =1.0.0 - django-brazilian-zipcode =0.1.0 -...

CVE-2020-22312

A cross-site scripting XSS vulnerability was discovered in the OJ/admin-tool /calscores.php function of HZNUOJ v1.0...

CVE-2020-22312

A cross-site scripting XSS vulnerability was discovered in the OJ/admin-tool /calscores.php function of HZNUOJ v1.0...

Cross site scripting

A cross-site scripting XSS vulnerability was discovered in the OJ/admin-tool /calscores.php function of HZNUOJ v1.0...

CVE-2020-22312

CVE-2020-22312 affects HZNUOJ v1.0, with a cross-site scripting (XSS) vulnerability in the OJ/admin-tool/cal_scores.php function. The issue is documented in multiple sources (NVD entry, Red Hat, CVE lists) as an XSS risk, but the connected records do not provide a concrete remediation, patch vers...

CVE-2020-22312

A cross-site scripting XSS vulnerability was discovered in the OJ/admin-tool /calscores.php function of HZNUOJ v1.0...

Hznuoj 跨站脚本漏洞

Hznuoj is an open source online referee based on Hustoj by the individual developer Lixin Wei in China. A security vulnerability exists in HZNUOJ, which stems from a cross-site scripting vulnerability found in the OJ admin-tool cal scores.php function in HZNUOJ v1.0...

admin-tool-button (>=1.0.1a0 <=1.0.5a0), apis-ampel (=0.1.0) +44 more potentially affected by CVE-2021-31542 via django (>=3.2.0 <=3.2.0rc1)

django PYPI version =3.2.0, =1.0.1a0, =0.2.0, =0.14.0, =0.13.0, =0.8.0, =0.9.16 and more Source cves: CVE-2021-31542 Source advisory: OSV:GHSA-RXJP-MFM9-W4WR...

CVE-2021-26549

An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site...

PT-2022-8589 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.8.2 Moodle versions prior to 3.7.5 Moodle versions prior to 3.6.9 Moodle versions prior to 3.5.11 Description: The issue is related to insufficient input escaping applied to the PHP unit webrunner admin tool...

CVE-2019-10186

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey CSRF token was not being utilised by the XML loading/unloading admin tool...

UBUNTU-CVE-2019-10186

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey CSRF token was not being utilised by the XML loading/unloading admin tool...

CVE-2019-10186

Moodle CVE-2019-10186 affects Moodle installations prior to 3.7.1, 3.6.5, and 3.5.7. The root cause is that a sesskey CSRF token was not utilized by the XML loading/unloading admin tool, enabling CSRF-related risk. Impact is described as partial confidentiality, integrity, and availability concer...

GHSA-RF7Q-XQM3-6923 Apache Ranger allows remote authenticated administrators to inject arbitrary web script or HTML

Cross-site scripting XSS vulnerability in the create user functionality in the policy admin tool in Apache Ranger before 0.6.1 allows remote authenticated administrators to inject arbitrary web script or HTML via vectors related to policies...