CVE-2024-27185

The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors...

CVE-2024-27185

CVE-2024-27185 affects Joomla core: the pagination class accepts arbitrary parameters in links, which can lead to cache poisoning attack vectors. The vulnerability is documented across multiple feeds (NVD, OSV, Nessus/NASL) with a reported CVSS v3.1 base score of 9.1 (CRITICAL) and an attack vect...

CVE-2024-27185 [20240802] - Core - Cache Poisoning in Pagination

The pagination class includes arbitrary parameters in links, leading to cache poisoning attack vectors...

Joomla! 安全漏洞

Joomla! is a free, open-source content management system open-sourced by Joomla! A security vulnerability exists in Joomla! versions 3.0.0 through 3.10.16-elts, 4.0.0 through 4.4.6, and 5.0.0 through 5.1.2, which stems from a paging class that contains arbitrary parameters in a link, which can le...

Apache OpenOffice Parameter Injection Vulnerability

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents, spreadsheets, presentations, drawings, databases and more. A security vulnerability exists in Apache OpenOffice versions 4.1.14 and earlier, which stems from a...

CVE-2023-31473

Summary: CVE-2023-31473 affects GL.iNet devices prior to v3.216. A command-injection flaw with a filter allows an attacker to cause opkg to read an arbitrary file name as root, enabling arbitrary file write anywhere on the filesystem. This is possible through the software installation feature, wi...

CVE-2023-31474

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name...

Information disclosure

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name...

CVE-2023-31474

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name...

CVE-2023-31474

An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to inject arbitrary parameters in a request to cause opkg to obtain a list of files in a specific directory, by using the regex feature in a package name...

Apache OpenOffice Code Execution Vulnerability (CNVD-2023-25931)

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents , spreadsheets , presentations , drawings , databases and so on. A code execution vulnerability exists in Apache OpenOffice that originates from a link containing an...

Apache OpenOffice 参数注入漏洞

Apache OpenOffice is an open source office software suite from the U.S. Apache Apache Foundation. The suite contains text documents , spreadsheets , presentations , drawings , databases and so on. A code execution vulnerability exists in Apache OpenOffice that originates from a link containing an...

Typecho 跨站脚本漏洞

typecho is a PHP blogging platform for typecho individual developers. It is simple and powerful. A security vulnerability exists in Typecho v.1.2.0, which is caused by a cross-site scripting vulnerability that can be exploited by remote attackers to execute arbitrary code via arbitrary URL...

CVE-2022-41347

An issue was discovered in Zimbra Collaboration ZCS 8.8.x and 9.x e.g., 8.8.15. The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes...

Default configuration

An issue was discovered in Zimbra Collaboration ZCS 8.8.x and 9.x e.g., 8.8.15. The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes...

CVE-2022-41347

CVE-2022-41347 affects Zimbra Collaboration Suite (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The issue arises from a sudo configuration that allows the zimbra user to execute the NGINX binary as root with arbitrary parameters. Since NGINX can load a user-defined configuration file that loads plugins as ...

CVE-2022-41347

An issue was discovered in Zimbra Collaboration ZCS 8.8.x and 9.x e.g., 8.8.15. The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes...

Zimbra Collaboration Suite 安全漏洞

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A security vulnerability exists in Zimbra Collaboration Suite ZCS version 8.8.x, version 9.x. The vulnerability can be exploited by an attacker to...

CVE-2022-37393

Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root...

CVE-2022-37393 Zimbra zmslapd arbitrary module load

Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root...