CVE-2021-3110

The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade idproducts parameter...

Prestashop SQL injection vulnerability

Prestashop is a set of open source e-commerce solutions from the United States Prestashop. The solution provides a variety of payment methods , short message alerts and product image scaling and other features . PrestaShop 1.7.7.0 suffers from a SQL injection vulnerability in which the source...

XWiki cross-site scripting vulnerabilities

Xwiki is a Wiki platform for creating Web collaboration applications from the French company Xwiki. XWiki version 12.10.2 contains a cross-site scripting vulnerability that could be exploited to launch a cross-site scripting attack against a target via the SVG document upload comment feature...

IBM Workload Automation Information Disclosure Vulnerability (CNVD-2021-03565)

IBM Workload Automation is an American IBM software for batch and real-time workload management. An information disclosure vulnerability exists in IBM Workload Automation version 9.5 that originates from storing sensitive information in HTML comments, which can be exploited by an attacker to obta...

IBM Workload Automation Information Disclosure Vulnerability (CNVD-2021-03568)

IBM Workload Automation boosts productivity and enhances management of enterprise business workloads through a blend of automation and application analytics. An information disclosure vulnerability exists in IBM Workload Automation 9.5. The vulnerability stems from the program storing sensitive...

CVE-2020-4673

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

CVE-2020-4673

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

Information disclosure

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

CVE-2020-4673

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

CVE-2020-4673

The CVE-2020-4673 vulnerability affects IBM Workload Automation 9.5 (IBM Workload Scheduler 9.5.x). The root cause is information disclosure via sensitive data stored in HTML comments in the Dynamic Workload Console, enabling an attacker to access potentially sensitive information and aid further...

CVE-2020-4673: Insecure Storage of Sensitive Information

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

PT-2021-12155

Name of the Vulnerable Software and Affected Versions IBM Workload Automation version 9.5 Description The issue allows sensitive information to be stored in HTML comments, which could aid in further attacks against the system. Recommendations For IBM Workload Automation version 9.5, consider...

IBM Workload Automation information leakage vulnerability

IBM Workload Automation is an American IBM software for batch and real-time workload management. An information disclosure vulnerability exists in IBM Workload Automation version 9.5 that originates from storing sensitive information in HTML comments, which can be exploited by an attacker to obta...

CVE-2020-23960

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...

Security Bulletin: HTML comments with sensitive information could be present in IBM Workload Scheduler

Summary HTML comments with sensitive information, as file locations, machine or user names, could be present in IBM Dynamic Workload Console 9.5 Vulnerability Details CVEID: CVE-2020-4673 DESCRIPTION: IBM Workload Automation stores sensitive information in HTML comments that could aid in further...

CVE-2020-4673

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized...

Code injection

A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...

IPS Community Suite Cross-Site Scripting Vulnerability

IPS Community Suite is an Internet community software produced mainly by Invision Power Services, which is written in PHP and uses MySQL as a database management system. Versions of IPS Community Suite prior to 4.5.4.2 are vulnerable to a cross-site scripting vulnerability during a quoted post or...