449 matches found
CVE-2019-12903
Pydio Cells before 1.5.0, when supplied with a Name field in an unexpected Unicode format, fails to handle this and includes the database column/table name as pert of the error message, exposing sensitive information...
CVE-2019-12902
Pydio Cells vulnerable before version 1.5.0. The issue is incomplete cleanup of a user’s data on deletion, allowing a new user with the same User ID to recover the deleted user’s data. Affected platform: Pydio Cells prior to 1.5.0; root cause: data cleanup gap during deletion. Impact: potential i...
CVE-2019-12902
Pydio Cells before 1.5.0 does incomplete cleanup of a user's data upon deletion. This allows a new user, holding the same User ID as a deleted user, to restore the deleted user's data...
CVE-2019-12901
Pydio Cells before 1.5.0 fails to neutralize '../' elements, allowing an attacker with minimum privilege to Upload files to, and Delete files/folders from, an unprivileged directory, leading to Privilege escalation...
CVE-2019-12901
Pydio Cells (before version 1.5.0) contains an input handling flaw where '../../' path elements are not neutralized, enabling a user with minimal privileges to upload or delete files in an unprivileged directory and thus escalate privileges. The issue is documented across multiple sources (NVD, R...
CVE-2018-15755
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...
CVE-2018-15755
Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, contain an internal api endpoint vulnerable to SQL injection between Diego cells and the policy server. A remote authenticated malicious user with mTLS certs can issue arbitrary SQL queries and gain access to the policy server...
Description of the security update for Excel 2016: September 11, 2018
None None...
Cells Blog Cross-Site Scripting Vulnerability (CNVD-2018-00086)
Cells Blog is a free but powerful mini blogging system. A cross-site scripting vulnerability exists in Cells Blog 3.5. An attacker can exploit this vulnerability via the pubreadpost.php fmid parameter to conduct a cross-site scripting attack...
Cells Blog SQL Injection Vulnerability
Cells Blog is a free but powerful mini blogging system. Cells Blog 3.5 suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability by using the pubreadpost.php ptid parameter to conduct a SQL injection attack...
Cells Blog Cross-Site Scripting Vulnerability
Cells Blog is a free but powerful mini blogging system. A cross-site scripting vulnerability exists in Cells Blog 3.5. An attacker can exploit this vulnerability by using the jfdname parameter in the act=showpic request to conduct a cross-site scripting attack...
CVE-2017-17949
Cells Blog 3.5 has XSS via the pubreadpost.php fmid parameter...
CVE-2017-17950
Cells Blog 3.5 has SQL Injection via the pubreadpost.php ptid parameter...
CVE-2017-17950
Cells Blog 3.5 has SQL Injection via the pubreadpost.php ptid parameter...
CVE-2017-17948
Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request...
Sql injection
Cells Blog 3.5 has SQL Injection via the pubreadpost.php ptid parameter...
CVE-2017-17948
Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request...
Code injection
Cells Blog 3.5 has XSS via the pubreadpost.php fmid parameter...