CVE-2022-32740

A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...

CVE-2022-27174

Cross-site request forgery CSRF vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authentication of the administrator and delete a blog article or a category via a specially crafted page...

CVE-2021-40961

CMS Made Simple =2.2.15 is affected by SQL injection in modules/News/function.adminarticlestab.php. The $sortby variable is concatenated with $query1, but it is possible to inject arbitrary SQL language without using the '...

CMS Made Simple SQL注入漏洞

CMS Made Simple CMSMS is an open source content management system CMS by Cmsms team. The system supports role-based permission management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A security vulnerability exists in CMS Made Simple version...

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability

UPDATE July 12, 2022: As part of the response by Microsoft, a defense in depth variant has been found and fixed in the Windows July cumulative updates. Microsoft recommends installing the July updates as soon as possible. Windows Version Link to KB article LInk to Catalog Windows 8.1, Windows...

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability

UPDATE July 12, 2022: As part of the response by Microsoft, a defense in depth variant has been found and fixed in the Windows July cumulative updates. Microsoft recommends installing the July updates as soon as possible. Windows Version Link to KB article LInk to Catalog Windows 8.1, Windows...

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability

UPDATE July 12, 2022: As part of the response by Microsoft, a defense in depth variant has been found and fixed in the Windows July cumulative updates. Microsoft recommends installing the July updates as soon as possible. Windows Version Link to KB article LInk to Catalog Windows 8.1, Windows...

PDF24 Article To PDF <= 4.2.2 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack input t...

Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journalarticle/page.jsp in journal/journal-taglib...

GHSA-M2GX-7PVX-3GVG Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journalarticle/page.jsp in journal/journal-taglib...

Improper Access Control

Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Improper Access Control where a low-privileged user can modify and delete admin articles by changing the value of the articleid parameter. Remediation...

PT-2022-14130 · Publify · Publify

Name of the Vulnerable Software and Affected Versions: publify/publify versions prior to 9.2.9 Description: The issue allows a low-privileged user to bypass authorization and access sensitive information by manipulating a user-controlled key. Specifically, this can be achieved by modifying the...

Liferay Portal Vulnerable to XSS via a Knowledge Base Article Title

XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title...

GHSA-75X7-W445-5GWR Liferay Portal Vulnerable to XSS via a Knowledge Base Article Title

XSS exists in Liferay Portal before 7.0 CE GA4 via a Knowledge Base article title...

GHSA-5JM7-G527-M694 Publify exposes article metadata

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integri...

CVE-2022-29306

IonizeCMS v1.0.8.1 was discovered to contain a SQL injection vulnerability via the idpage parameter in application/models/articlemodel.php...

Ionize SQL注入漏洞

Ionize is a free professional and native multi-language PHP CMS. dedicated to web designers and web agencies to simply delight their customers. A security vulnerability exists in Ionize v1.0.8.1, which originates from a SQL injection point in application/models/articlemodel.php in the Insurance...

CSZ CMS 1.3.0 - (Multiple) Blind SQL injection Vulnerability

Exploit Title: CSZ CMS 1.3.0 - 'Multiple' Blind SQLi Exploit Author: Dogukan Dincer Vendor Homepage: https://www.cszcms.com/ Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/download Version: 1.3.0 Tested on: Kali Linux, Windows 10, PHP 7.2.4, Apache 2.4...

2022-05 Cumulative Update for Windows 10 Version 1809 for x86-based Systems (KB5013941)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...