1770 matches found
Incorrect handling of credential expiry by /nats-io/nats-server
This advisory is canonically https://advisories.nats.io/CVE/CVE-2020-26892.txt Problem Description NATS nats-server through 2020-10-07 has Incorrect Access Control because of how expired credentials are handled. The NATS accounts system has expiration timestamps on credentials; the library had an...
CVE-2020-27232
An exploitable SQL injection vulnerability exists in ‘manageServiceStocks.jsp’ page of OpenClinic GA 5.173.3. A specially crafted HTTP request can lead to SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability...
PHPGurukul Beauty Parlour Management System Cross-Site Scripting Vulnerability
PHPGurukul Beauty Parlour Management System is an application from PHPGurukul Inc. A beauty parlor management system. A cross-site scripting vulnerability exists in PHPGurukul Beauty Parlour Management System v1.0, which can be exploited by a remote attacker to execute arbitrary code by injecting...
Chamilo LMS 跨站请求伪造漏洞
Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training and online question and answer sessions. A cross-site request forgery vulnerability exists in Chamilo LMS version...
NVMS ABB Ability Ellipse APM Cross Site Scripting Vulnerability
NVMS ABB Ability Ellipse APM is an application from NVMS Thailand. It provides operational status and performance insights to prevent critical asset failures while optimizing asset lifecycle costs. Ellipse APM versions prior to 5.3.0.1, 5.2.0.3, and 5.1.0.6 are vulnerable to a cross-site scriptin...
Cross site scripting
Cross Site Scripting XSS in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. This allows attackers to craft a malicious URL, which when clicked on by users, can inject javascript code to be run by the application...
The vulnerability of the web application of the 1C:Enterprise system, related to the storage and transmission of data in an open manner, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the 1C:Enterprise web application relates to the storage and transmission of data in an open manner. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...
CVE-2020-27937
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, macOS Big Sur 11.0.1. A malicious application may be able to access private information...
Kopano Groupware Core Denial of Service Vulnerability
Kopano Groupware Core is an application from the Dutch company Kopano. Provides Groupware features for Kopano stacks and in most cases they are the core of every Kopano environment. A denial of service vulnerability exists in Kopano Groupware Core, which can be exploited by an attacker to exhaust...
Meow Street App Has Denial of Service Vulnerability
Meow Street APP by Alibaba's new consumer shopping tool, is the entity business to build "Internet +" platform. A denial of service vulnerability exists in Meow Street APP. An attacker can exploit the vulnerability to cause the application to crash...
Online Faculty Clearance System 1.0 Cross Site Scripting
Exploit Title: Online Faculty Clearance System Persistent Cross Site Scripting Exploit Author: th3d1gger Vendor Homepage: https://sourcecodester.com Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/onlineclearance0.zip Version: 1.0 Tested on Windows 10 @attack...
Companion Heart App in Denial of Service Vulnerability
Companion Heart App is an online voice and video socialization application, with voice chat rooms, game competition and other online and offline sharing skills themed interactions, mutual invitations, and socialization based on interests. Companion Heart App is vulnerable to a denial of service...
The vulnerability of the Intel Data Migration application, related to errors in using standard permissions, allows a perpetrator to increase their privileges.
The vulnerability of the Intel Data Migration application is related to errors in the use of standard permissions. Exploiting this vulnerability can allow an attacker to increase their privileges...
UltimateKode Neo Billing Cross-Site Scripting Vulnerability
Envato Neo Billing is an Envato open source application. Provides a well-designed enterprise billing and accounting solution. UltimateKode Neo Billing before 3.5 suffers from a cross-site scripting XSS vulnerability that stems from the lack of proper validation of client-side data in the WEB...
Unspecified Vulnerability in Samsung Mobile MobileWips
Samsung Mobile MobileWips is an application from Samsung Mobile, a South Korean company. It provides an application that comes with Samsung cell phones. A security vulnerability exists in SMR Feb-2021 Release 1 that allows unauthorized operations, including denial-of-service attacks, by hijacking...
Apache MyFaces Cross-Site Request Forgery Vulnerability
Apache MyFaces Trinidad is a U.S. Apache Apache Foundation contains a large number of enterprise-class component libraries and support for attachment JSF framework. A cross-site request forgery vulnerability exists in Apache MyFaces. The vulnerability stems from a lack of proper validation of...
Schneider PowerLogic 产品跨站请求伪造漏洞
F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A buffer overflow vulnerability exists in BIG-IP, which originates when a network system or product performs an operation in...
Apache MyFaces Trinidad 跨站请求伪造漏洞
Apache MyFaces Trinidad is a U.S. Apache Apache Foundation contains a large number of enterprise-class component libraries and support for attachment JSF framework. A cross-site request forgery vulnerability exists in Apache MyFaces. The vulnerability stems from a lack of proper validation of...
Sourcecodester Pisay Online E-Learning System SQL注入漏洞
Sourcecodester Pisay Online E-Learning System is an online e-learning system based on PHP and MySQL. Sourcecodester Pisay Online E-Learning System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in a database-based...
