PT-2024-6630

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.44799 Description: The issue is related to insufficient authorization mechanisms in JetBrains YouTrack, allowing access to global app config data without proper permissions. This could enable a remo...

CVE-2023-38942

Dango-Translator v4.5.5 was discovered to contain a remote command execution RCE vulnerability via the component app/config/cloudconfig.json...

CVE-2023-38942: Improper Neutralization of Special Elements used in a Command

Dango-Translator v4.5.5 was discovered to contain a remote command execution RCE vulnerability via the component app/config/cloudconfig.json...

CVE-2021-4290

A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/config/passport.js of the component Login. The manipulation of the argument id/email leads to sql injection. The name of the patch is...

CVE-2021-4290: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in DHBW Fallstudie. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file app/config/passport.js of the component Login. The manipulation of the argument id/email leads to sql injection. The name of the patch is...

MAL-2022-745 Malicious code in @xvideos/app-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a290ede58fb80e2b89f5ecbce9b539c5c5de67e3d8a2ab54c2a6feb09e67973f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unable to load settings with Global App Config Service on Citrix Workspace app Chrome OS/HTML5

If the administrator has rolled out any settings via Global App Config Service and a user launches the Citrix Workspace app, it may happen that the settings rolled out previously by the administrator may not be applied. If the administrator now tries to roll out any new settings via Global App...

PT-2021-10298

Name of the Vulnerable Software and Affected Versions: S-CMS versions 20191014 and earlier Description: The issue allows remote attackers to execute arbitrary code via the Site Title parameter of the component "/data/admin//app/config/". This enables attackers to perform Cross Site Scripting XSS...

CVE-2020-19158: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in S-CMS build 20191014 and earlier allows remote attackers to execute arbitrary code via the 'Site Title' parameter of the component '/data/admin//app/config/'...

PT-2021-10539

Name of the Vulnerable Software and Affected Versions: S-CMS PHP version 3.0 Description: A stored cross site scripting XSS issue exists, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload in the /app/config/ endpoint. Recommendations: For S-CMS PHP version 3.0,...

CVE-2020-20701: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting XSS vulnerability in /app/config/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2019-11426

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

CVE-2019-11426: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in app/admincp/template/admincp.header.php in idreamsoft iCMS 7.0.14 via the admincp.php?app=config tab parameter...

CVE-2018-16320

idreamsoft iCMS 7.0.11 allows admincp.php?app=config Directory Traversal, resulting in execution of arbitrary PHP code from a ZIP file...

PT-2018-13486

Name of the Vulnerable Software and Affected Versions idreamsoft iCMS version 7.0.11 Description The issue allows for Directory Traversal, resulting in the execution of arbitrary PHP code from a ZIP file. This can be achieved through the admincp.php application, specifically by accessing the...

Fiyo CMS Arbitrary File Deletion Vulnerability

FiyoCMS is a content management system CMS for creating CMS templates. An arbitrary file deletion vulnerability exists in the dapur/apps/appconfig/controller/backuper.php file in FiyoCMS version 2.0.7. An attacker can exploit this vulnerability to delete arbitrary files...

PT-2017-18583

Name of the Vulnerable Software and Affected Versions Fiyo CMS version 2.0.7 Description The issue concerns an arbitrary file delete vulnerability. It is located in the dapur/apps/app config/controller/backuper.php file via directory traversal in the file parameter during an act=db action...

CVE-2013-7134: Undefined Security Weakness

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secrettoken.rb, related to cookies...

CVE-2012-1248

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...

CVE-2012-1248: Undefined Security Weakness

app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain...