68 matches found
Remote code execution
In ATutor 2.2.4, an unauthenticated attacker can change the application settings and force it to use his crafted database, which allows him to gain access to the application. Next, he can change the directory that the application uploads files to, which allows him to achieve remote code execution...
CVE-2019-16114
ATutor 2.2.4 is affected by CVE-2019-16114. An unauthenticated attacker can first modify application settings to force the use of a crafted database, enabling access to the application. The attacker can then alter the upload directory, enabling remote code execution. The root cause is that instal...
Cross site request forgery (csrf)
An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element containing a user/card.php CSRF request in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. The protection mechanism for CSRF is to check the Referer...
Information Disclosure Through Date Template Filter
Django is vulnerable to information disclosure. This vulnerability is caused in the getformat function in utils/formats.py which allows a malicious user to obtain any secret in the application settings by specifying a settings key name instead of a date format...
U.S. Dept Of Defense: Unencrypted __VIEWSTATE parameter in a DoD website
Hi there i realise that the information passing to the server in the subdomain http://████████ can be seen without any encryption thought the VIEWSTATE Parameter. To reduce the change of someone interception the information the parameter should be encrypted due to the sensivity of the information...
WESEEK GROWI cross-site scripting vulnerability (CNVD-2021-17765)
WESEEK GROWI is an open source team collaboration software developed by WESEEK Japan. The software features asset management, quick search and member management. A cross-site scripting vulnerability exists in WESEEK GROWI 3.1.11 and earlier versions. A remote attacker can exploit this vulnerabili...
Mail.ru: Modifying application settings via clickjacking on o2.mail.ru
It was possible to edit application information or delete application via clickjacking on o2.mail.ru...
python-django: Information leak through date template filter
An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format...
python-django: Information leak through date template filter
An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format...
python-django: Information leak through date template filter
An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format...
python-django: Information leak through date template filter
An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format...
python-django: Information leak through date template filter
An information-exposure flaw was found in the Django date filter. If an application allowed users to provide non-validated date formats, a malicious end user could expose application-settings data by providing the relevant applications-settings key instead of a valid date format...
python-django date template filter information disclosure vulnerability
Django is the open source Python Web application development framework. A security vulnerability exists in the date template filter of python-django. A remote attacker can exploit this vulnerability to obtain sensitive information within the application settings...
Ubuntu 14.04 LTS : Django vulnerability (USN-2816-1)
The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2816-1 advisory. Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from...
USN-2816-1: Django vulnerability
Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from application settings...
USN-2816-1 python-django vulnerability
Ryan Butterfield discovered that Django incorrectly handled the date template filter. A remote attacker could possibly use this issue to obtain secrets from application settings...
django -- information leak vulnerability
Tim Graham reports: If an application allows users to specify an unvalidated format for dates and passes this format to the date filter, e.g. lastupdated|date:userdateformat , then a malicious user could obtain any secret in the application's settings by specifying a settings key instead of a dat...
CF Image Host 1.65 - Cross-Site Request Forgery
input type="text"...
CVE-2012-4921
Multiple cross-site request forgery CSRF vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change application settings or 2 conduct cross-site scripting XSS attacks...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the DVS Custom Notification plugin 1.0.1 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change application settings or 2 conduct cross-site scripting XSS attacks...