CVE-2021-42235

SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality...

CVE-2021-42235

SQL injection in osTicket before 1.14.8 and 1.15.4 login and password reset process allows attackers to access the osTicket administration profile functionality...

Talend Administration Center 代码问题漏洞

Talend Administration Center is a web-based application from Talend that allows centralized studio management. A security vulnerability exists in Talend Administration Center that originates from the use of the "Add" function of the service registry to perform cross-site request forgery of HTTP G...

Talend Administration Center 代码问题漏洞

Talend Administration Center is a web-based application from Talend that centralizes studio management. A security vulnerability exists in Talend Administration Center. An attacker exploits the vulnerability to use XML External Entities XXE to achieve root read access on a remote file system...

GHSA-678X-XFP4-R92R Apache Geronimo Application Server CSRF vulnerabilities

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that 1 change the web administration password, 2 upload application...

Apache Geronimo Application Server CSRF vulnerabilities

Multiple cross-site request forgery CSRF vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that 1 change the web administration password, 2 upload application...

GHSA-C372-X57P-6X7V Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...

Apache Geronimo Application Server multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 ip, 3 username, or 4 description parameter to console/portal/Server/Monitorin...

GHSA-R5CJ-WV24-92P5 Django cross-site request forgery (CSRF) vulnerability

The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery CSRF attacks and delete or modify data via unspecified...

Django cross-site request forgery (CSRF) vulnerability

The administration application in Django 0.91.x, 0.95.x, and 0.96.x stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery CSRF attacks and delete or modify data via unspecified...

Django Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

GHSA-54QJ-48VX-CR9F Django Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

Django Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

CVE-2022-29906

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66 omits a check for the quizadmin user...

Authorization

Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints...

CVE-2021-43939

CVE-2021-43939 affects Elcomplus SmartPTT (SCADA/server endpoints). The vulnerability is improper authorization (CWE-285) that lets a low-authenticated user issue requests to admin-level endpoints, enabling privilege escalation with high impact to confidentiality, integrity and availability. Affe...

CVE-2021-43939 Elcomplus SmartPtt Improper Authorization

Elcomplus SmartPTT is vulnerable when a low-authenticated user can access higher level administration authorization by issuing requests directly to the desired endpoints...

RHEL 7 : web-admin-build (RHSA-2022:1628)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:1628 advisory. Red Hat Gluster Storage Web Administration includes a fully automated setup based on Ansible and provides deep metrics and insights into active Glust...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2022-61334)

OpenEMR is an open source medical management system from the OpenEMR community. A cross-site scripting vulnerability exists in versions of OpenEMR prior to 6.1.0.1, which stems from a lack of data validation filters for user-supplied data and output data in the file name on the "Upload Document...

The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services allows a perpetrator to execute arbitrary code.

The vulnerability of the EAS Console component of the Oracle Hyperion Essbase Administration Services exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via HTTP requests...