PT-2019-18127

Name of the Vulnerable Software and Affected Versions creditease-sec insight through 2018-09-11 Description An issue was discovered that allows CSRF in the role perm delete function located in srcpm/app/admin/views.py. Recommendations For creditease-sec insight through 2018-09-11, consider...

PT-2019-18129

Name of the Vulnerable Software and Affected Versions creditease-sec insight through 2018-09-11 Description An issue was discovered that allows CSRF in the user delete function, located in srcpm/app/admin/views.py. Recommendations For creditease-sec insight through 2018-09-11, consider implementi...

CVE-2019-6508: Cross-Site Request Forgery (CSRF)

An issue was discovered in creditease-sec insight through 2018-09-11. rolepermdelete in srcpm/app/admin/views.py allows CSRF...

CVE-2019-6510: Cross-Site Request Forgery (CSRF)

An issue was discovered in creditease-sec insight through 2018-09-11. userdelete in srcpm/app/admin/views.py allows CSRF...

CVE-2019-5310

YUNUCMS 1.1.8 is affected by a cross‑site scripting vulnerability in app/admin/controller/System.php. The issue allows crafted data to be written to the sys.php file, demonstrated by using site_title in an admin/system/basic POST request. This represents an XSS risk as described across multiple s...

CVE-2019-5310: Improper Neutralization of Input During Web Page Generation

YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by sitetitle in an admin/system/basic POST request...

CVE-2018-1000870

PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerability in /app/admin/users/print-user.php that can result in Execute code in the victims browser. This attack appear to be exploitable via Attacker change theme parameter in user settings. AdminVictim views user in admin-panel and gets...

PT-2018-9591

Name of the Vulnerable Software and Affected Versions: phpIPAM versions prior to 1.4 Description: The issue is related to a SQL Injection flaw that can be exploited to access unauthorized information. The vulnerability is present in the /app/admin/nat/item-add-submit.php file and can be exploited...

CVE-2018-19520: Improper Control of Generation of Code

An issue was discovered in SDCMS 1.6 with PHP 5.x. app/admin/controller/themecontroller.php uses a checkbad function in an attempt to block certain PHP functions such as eval, but does not prevent use of pregreplace 'e' calls, allowing users to execute arbitrary code by leveraging access to admin...

PT-2018-13274

Name of the Vulnerable Software and Affected Versions WUZHI CMS version 4.1.0 Description A SQL injection issue was found in the /coreframe/app/admin/pay/admin/index.php file of WUZHI CMS. The issue is related to the keyValue parameter in the "index.php?m=pay&f=index&v=listing" API endpoint...

CVE-2018-15894: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection was discovered in /coreframe/app/admin/pay/admin/index.php in WUZHI CMS 4.1.0 via the index.php?m=pay&f=index&v=listing keyValue parameter...

PT-2018-10237

Name of the Vulnerable Software and Affected Versions SDcms version 1.5 Description A cross-site request forgery CSRF issue allows remote attackers to add administrator accounts. This is possible via the "/WWW//app/admin/controller/admincontroller.php" endpoint with parameters such as m=admin,...

CVE-2017-6481

Multiple Cross-Site Scripting XSS issues were discovered in phpipam 1.2. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to several pages instructions in app/admin/instructions/preview.php; subnetId in app/admin/powerDNS/refresh-ptr-records.php. An attacker...

PT-2018-9592

Name of the Vulnerable Software and Affected Versions: PHPipam versions 1.3.2 and earlier Description: The issue concerns a CWE-79 vulnerability in the /app/admin/users/print-user.php file, which can lead to code execution in the victim's browser. This can be exploited by an attacker changing the...

PT-2019-5825

Name of the Vulnerable Software and Affected Versions phpIPAM version 1.4 Description The issue is related to a lack of protection against SQL structure manipulation in the app/admin/custom-fields/edit.php component of the phpIPAM web application. This can be exploited by a remote attacker to...

PT-2019-5827

Name of the Vulnerable Software and Affected Versions phpIPAM version 1.4 Description The issue is related to a lack of protection against SQL structure manipulation in the app/admin/custom-fields/order.php component of the phpIPAM web application. This can be exploited by a remote attacker to...

PT-2019-5829

Name of the Vulnerable Software and Affected Versions phpIPAM version 1.4 Description The issue is related to a lack of protection against SQL structure manipulation in the app/admin/custom-fields/filter.php component of the phpIPAM web application. This can be exploited by a remote attacker to...

X (Formerly Twitter): Fabric.io - an app admin can delete team members from other user apps

It is possible for an app admin to delete all the team members from other apps for which he doesn't have access. To reproduce the attack, create two apps and add different user roles as below, VictimApp - Aliceadmin, Alicemember HackerApp - Hackeradmin, Hackermember Before proceeding with the...

Gentoo Security Advisory GLSA 201003-01 (sudo)

The remote host is missing updates announced in advisory GLSA 201003-01. SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Gentoo Security Advisory GLSA 200403-14 (app-admin/monit)

The remote host is missing updates announced in advisory GLSA 200403-14. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...