[SECURITY] Fedora 42 Update: nextcloud-31.0.5-1.fc42

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

CVE-2024-42357

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the...

CVE-2024-42357: Improper Neutralization of Special Elements used in an SQL Command

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the...

CVE-2024-22406

Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations...

CVE-2024-22406: Improper Neutralization of Special Elements used in an SQL Command

Shopware is an open headless commerce platform. The Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the parameters in the “aggregations...

HaoKeKeJi YiQiNiu Code Issue Vulnerability

HaoKeKeJi YiQiNiu is an application from HaoKeKeJi. A code issue vulnerability exists in HaoKeKeJi YiQiNiu version 3.1 and prior versions, which stems from a cross-site request forgery vulnerability in the httppost function of the /application/pay/controller/Api.php file...

Likeshop Code Issue Vulnerability

Likeshop is a complete solution for social commerce strategy from Likeshop open source. A code issue vulnerability exists in Likeshop 2.5.7.20210311 and earlier versions, which stems from the parameter file in the file server/application/api/controller/File.php that can lead to unrestricted uploa...

CVE-2024-0352: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to...

CVE-2023-2886

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

Input validation

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2023-2886

The CVE-2023-2886 entry concerns CBOT Chatbot core software and its WebSockets origin validation. Affected: CBOT Chatbot Core prior to v4.0.3.4 and Panel prior to v4.0.3.7. Root cause: Missing Origin Validation in WebSockets, enabling content spoofing via the application API manipulation. Impact:...

CVE-2023-2886: Missing Origin Validation in WebSockets

Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7...

CVE-2018-14893

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API...

CVE-2018-14893

CVE-2018-14893 concerns ZyXEL NSA325 V2 (firmware version 4.81) with a command injection vulnerability in the zyshclient component. The flaw permits an attacker to execute system commands via the web application API. Multiple sources (NVD, CVE records, CNVD) describe the same issue, identifying z...

CVE-2018-14893

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API...

Command injection

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API...

PT-2018-12783

Name of the Vulnerable Software and Affected Versions ZyXEL NSA325 V2 version 4.81 Description A system command injection issue allows attackers to execute system commands via the web application API. Recommendations For ZyXEL NSA325 V2 version 4.81, at the moment, there is no information about a...

CVE-2018-14893: Improper Neutralization of Special Elements used in a Command

A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API...

PT-2018-9798

Name of the Vulnerable Software and Affected Versions: FastAdmin version 1.0.0.20180417 beta Description: An issue was discovered in the application, allowing for XSS via the avatar parameter in the User.php file, located at the "application/api/controller/" endpoint. Recommendations: For FastAdm...

CVE-2018-10268: Improper Neutralization of Input During Web Page Generation

An issue was discovered in FastAdmin V1.0.0.20180417beta. There is XSS via the application\api\controller\User.php avatar parameter...