CVE-2020-15903

An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3...

Privilege escalation

An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3...

CVE-2020-15903

CVE-2020-15903 concerns Nagios XI prior to 5.7.3, where a privilege escalation exists in backend scripts that run as root and reference included files that were writable by the nagios user. The root cause is improper file permissions in backend components, enabling elevated access. The vulnerabil...

CVE-2020-15903

An issue was found in Nagios XI before 5.7.3. There is a privilege escalation vulnerability in backend scripts that ran as root where some included files were editable by nagios user. This issue was fixed in version 5.7.3...

File Upload Vulnerability in CMS Backend

High Fives CMS is a free database-free CMS system. A file upload vulnerability exists in the backend of High Fives CMS. An attacker can exploit the vulnerability to upload a webshell and gain server privileges...

Directory Traversal Vulnerability in Xunrui CMS 4.3.11 Backend

Xunrui CMS system is a free, simple, efficient and flexible PHP content management system. A directory traversal vulnerability exists in the backend of XunRui CMS 4.3.11, which can be exploited by an attacker to traverse the server's directory information with permissions...

File Upload Vulnerability in OFCMS V1.1.4 Backend

OFCMS is a content management system developed based on java technology. A file upload vulnerability exists in the background of OFCMS version V1.1.4, which can be exploited by an attacker to gain administrative privileges on the server...

SQL Injection Vulnerability in ZZCMS Backend ba***.php File

ZZCMS is a free website builder developed in asp language. A SQL injection vulnerability exists in the ba.php file in the background of ZZCMS. Attackers can use this vulnerability to obtain sensitive information in the database...

Arbitrary file read vulnerability in S-CMS backend (CNVD-2020-57394)

S-CMS Government Station Building System, S-CMS School Station Building System, S-CMS News Portal System and S-CMS Enterprise Station Building System are developed by Zibo Shining Network Technology Co., Ltd. which is specialized in providing solutions for government station building.S-CMS Hospit...

SQL Injection Vulnerability in ZZCMS Backend as***.php File

ZZCMS is a free website builder developed in asp language. There is a SQL injection vulnerability in the as.php file in the background of ZZCMS. An attacker can use this vulnerability to obtain sensitive information from the database...

Information Disclosure

derhansen/sfeventmgt is vulnerable to information disclosure. Missing access checks in the backend module allows an authenticated user to export restricted participant data for events or send emails to event participants for events which the user does not have access to...

GHSA-G8RG-7RPR-CWR2 Information Disclosure in TYPO3 extension sf_event_mgt

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. Another missing access check in the backend module allows an authenticated backend user to send emai...

Information Disclosure in TYPO3 extension sf_event_mgt

A missing access check in the backend module allows an authenticated backend user to export participant data for events which the user does not have access to, resulting in Information Disclosure. Another missing access check in the backend module allows an authenticated backend user to send emai...

New Relic: Getting API access key Through Introspection query Graphql

The introspection query should only be allowed internally and should not be allowed to the general public. If we can fetch the entire back-end API documentation and calls available on a server then that can be very dangerous is many cases what if we could get our hands on some API calls only mean...

CVE-2020-5416

Cloud Foundry Routing Gorouter, versions prior to 0.204.0, when used in a deployment with NGINX reverse proxies in front of the Gorouters, is potentially vulnerable to denial-of-service attacks in which an unauthenticated malicious attacker can send specially-crafted HTTP requests that may cause...

File Read Vulnerability in KiteCMS Backend

KiteCMS open source web content management system CMS, the system is based on the framework ThinkPHP 5.1. version of the development, applicable to individuals and enterprises to quickly build a station and development needs. KiteCMS backend file reading vulnerability , attackers can use the...

Dropcontact: User registration using public domain email like gmail in place of professional email.

Like sais in the title, we were only checking and restricting professional email in frontend, which led to being able to register with an email which is not pro because we were not checking this info in the backend. User was able to register with public domain email like gmail by response...

ArticaTech Artica Web Proxy SQL Injection Vulnerability

ArticaTech Artica Proxy is an open source Artica proxy solution from the French company ArticaTech. An SQL injection vulnerability exists in the 'apikey' parameter of the fw.login.php file in Artica Web Proxy version 4.30.00000000. A remote attacker can exploit this vulnerability to bypass...

SQL Injection Vulnerability in YCCMS Backend (CNVD-2020-53330)

YCCMS is a PHP version of a lightweight CMS builder. There is a SQL injection vulnerability in the background of YCCMS, which can be exploited by attackers to obtain sensitive database information...

SQL Injection Vulnerability in YCCMS Backend

YCCMS is a PHP version of a lightweight website building system. There is a SQL injection vulnerability in the background of YCCMS, which can be exploited by attackers to obtain sensitive database information...