3604 matches found
Malicious Package
Overview beta-tools is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using beta-tools...
XSS Vulnerability in Extreme CMS Beta 1.6.7
Extreme CMS Beta is a php+mysql an open source CMS system. Extreme CMS Beta 1.6.7 suffers from an XSS vulnerability, which can be exploited by attackers to execute malicious code and obtain administrator cookies...
ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Product : ECK Hotel Version : 1.0-beta Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download Exploit Author: Mustafa Emre Gül...
ECK Hotel 1.0 Cross Site Request Forgery
Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery Add Admin Product : ECK Hotel Version : 1.0-beta Date: 2020-03-26 Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download Exploit Author: Mustafa Emre Gül Website: https://emregul.com.tr/ Tested...
Nick Chan Bot Operating System Command Injection Vulnerability
Nick Chan Bot is a private Discord bot written using the discord.js library. An operating system command injection vulnerability exists in versions prior to Nick Chan Bot 1.0.0-beta. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc...
CVE-2020-5282
In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...
Command injection
In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...
CVE-2020-5282
In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...
Design/Logic Flaw
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...
CVE-2020-8986
CVE-2020-8986 affects ZendTo prior to 5.22-2 Beta. The issue is in lib/NSSDropbox.php where equality is not correctly checked when validating the session cookie, enabling an attacker to gain administrative access with a large number of requests. The Red Hat/NVD entries corroborate the impact and ...
CVE-2020-8985
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality...
GHSA-G9RQ-X4FJ-F5HX Remote Code Execution Through Image Uploads in BookStack
Impact A user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area o...
Knockout.js < 3.5.0-beta Cross-site Scripting
According to its self-reported version number, Knockout.js is prior to 3.5.0-beta. Therefore, it may be affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source...
Sql injection
SQL injection vulnerability in search.php in phxEventManager 2.0 beta 5 allows remote attackers to execute arbitrary SQL commands via the searchterms parameter...
CVE-2020-8123
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application...
CVE-2020-8123
CVE-2020-8123 affects Strapi up to v3.0.0-beta.18.3 and earlier. The vulnerability arises in the admin console where installPlugin/uninstallPlugin paths pass user input to execa after a regex check, allowing argument injection via inputs like -h, --help, -v, or --version. This can cause the serve...
Design/Logic Flaw
Eclair through 0.3 allows attackers to trigger loss of funds because of Incorrect Access Control. NOTE: README.md states "it is beta-quality software and don't put too much money in it."...
CVE-2019-14863
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...
D-Link DIR-859 Information Disclosure Vulnerability
The D-Link DIR-859 is a wireless AC1750 high power Wi-Fi Gigabit router. An information disclosure vulnerability exists in D-Link DIR-859 versions prior to 1.07b03beta, which can be exploited by an attacker to obtain information via the AUTHORIZEDGROUP=1%0a value...