CVE-2024-0248 EazyDocs < 2.4.0 - Subscriber+ Arbitrary Posts Deletion and Document Management

The EazyDocs WordPress plugin before 2.4.0 re-introduced CVE-2023-6029 https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/ in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was...

The vulnerability of PMB electronic document management software lies in its ability to download files of a malicious nature without limitation. This allows attackers to execute arbitrary code and increase their privileges.

The vulnerability of PMB electronic document management software is related to the unlimited loading of dangerous types of files. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and increase their privileges through a specially created PHP file...

CVE-2024-0599

A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\main\java\com\jspxcms\core\web\back\InfoController.java of the component Document Management Page. The manipulation of the argument title...

Cross site scripting

A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\main\java\com\jspxcms\core\web\back\InfoController.java of the component Document Management Page. The manipulation of the argument title...

CVE-2024-0599

CVE-2024-0599 affects Jspxcms 10.2.0 in the Document Management Page, specifically the InfoController.java component. The vulnerability is a cross-site scripting (XSS) flaw caused by unsafely handling the title argument, enabling remote exploitation. Public exploit availability is indicated in th...

CVE-2024-0599 Jspxcms Document Management Page InfoController.java cross site scripting

A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\main\java\com\jspxcms\core\web\back\InfoController.java of the component Document Management Page. The manipulation of the argument title...

CVE-2023-52098

Denial of Service DoS vulnerability in the DMS module. Successful exploitation of this vulnerability will affect availability...

EazyDocs < 2.4.0 - Subscriber+ Arbitrary Posts Deletion and Document Management

Description The plugin re-introduced CVE-2023-6029 https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/ in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was partially fixed in 2.3.9....

EazyDocs < 2.4.0 - Subscriber+ Arbitrary Posts Deletion and Document Management

Description The plugin re-introduced CVE-2023-6029 https://wpscan.com/vulnerability/7a0aaf85-8130-4fd7-8f09-f8edc929597e/ in 2.3.8, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. The issue was partially fixed in 2.3.9...

Jspxcms Cross-Site Scripting Vulnerability

BlueIntelligence Jspxcms is a scalable enterprise-level open source web content management system CMS from China's BlueIntelligence Technology Company. A cross-site scripting vulnerability exists in Jspxcms version 10.2.0, which stems from a cross-site scripting XSS vulnerability in the component...

PT-2024-14395 · Unknown · Dms Module

Name of the Vulnerable Software and Affected Versions: DMS module affected versions not specified Description: A Denial of Service DoS issue in the DMS module can be exploited to affect availability. The vulnerability allows for successful exploitation to impact the system's availability...

CVE-2023-6029 EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management

The EazyDocs WordPress plugin before 2.3.6 does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing unauthenticated users to delete arbitrary posts, as well as add and delete documents/sections...

EazyDocs < 2.3.6 - Subscriber+ Arbitrary Posts Deletion and Document Management

Description The plugin does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. PoC 1. Install the...

EazyDocs < 2.3.6 - Subscriber+ Arbitrary Posts Deletion and Document Management

Description The plugin does not have authorization and CSRF checks when handling documents and does not ensure that they are documents from the plugin, allowing any authenticated users, such as subscriber to delete arbitrary posts, as well as add and delete documents/sections. 1. Install the...

Design/Logic Flaw

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

CVE-2023-6376

CVE-2023-6376 affects Henschen & Associates court document management software. The root cause is insufficient randomization of cached document filenames, enabling a remote, unauthenticated attacker to access restricted documents by predicting cache paths. Exploitation details beyond this are not...

CVE-2023-6376 Henschen & Associates court document management software cache uses predictable file names

Henschen & Associates court document management software does not sufficiently randomize file names of cached documents, allowing a remote, unauthenticated attacker to access restricted documents...

Henschen & Associates court document management software Security Feature Issue Vulnerability

Henschen & Associates court document management software is a court document management software from Henschen & Associates. A security vulnerability exists in Henschen & Associates court document management software, which arises from insufficient randomization of the filenames of cached...

How to use DSF Collections & Index Patterns – A Tutorial

In conventional terminology, Imperva Data Security Fabric DSF is a database system, replete with a GUI interface for aggregation pipeline building, workflow orchestration, extensible scripting Playbooks, and self-service data discovery Kibana-based Discover. Imperva DSF is purpose-built for data...

Command Execution Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2023-87982)

Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...