ProjeQtOr Project Management 9.1.4 - Remote Code Execution Vulnerability

Exploit Title: ProjeQtOr Project Management 9.1.4 - Remote Code Execution Exploit Author: Temel Demir Vendor Homepage: https://www.projeqtor.org Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV9.1.4.zip Version: v9.1.4 Tested on: Laragon @WIN10 Description : Remote co...

CVE-2021-32621

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 12.6.7 and 12.10.3, a user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. The issue has been...

CVE-2021-32621

Summary: CVE-2021-32621 affects XWiki Platform. In versions before 12.6.7 and 12.10.3, a user without Script or Programming rights can edit gadget titles in the dashboard to run scripts with privileges. The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1. Impact (as stated): enables s...

Nextcloud: Federated editing allows iframing possibly malicious remotes

So this attack is less likely now that you killed the trusted server auto adding. But as far as I could tell you did not clear out old servers. Let me first describe the attack: 1. UserA on ServerA sends a federated share to userB on serverB 2. Assume serverA and serverB are trusted servers 3. No...

Arbitrary File Deletion Vulnerability in Joomla!

SP Page Builder plugin is a free page builder component that users can use on joomla sites to design and edit site page content. An arbitrary file deletion vulnerability exists in Joomla! SP Page Builder, which can be exploited to delete arbitrary files on the target server...

CVE-2020-26680

In vFairs 3.3, any user logged in to a vFairs virtual conference or event can modify any other users profile information to include a cross-site scripting payload. The user data stored by the database includes HTML tags that are intentionally rendered out onto the page, and this can be abused to...

WordPress 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress Membership & Learning Management System Plugin for WordPress plugin prior to version 4.21.1, which stems from the plugin generating...

Denial of Service Vulnerability in OP20 Series Screen Setup Tool

OP20 is a screen editing software developed by Wuxi Xinjie Electric Co. A denial-of-service vulnerability exists in the OP20 Series Screen Setting Tool, which can be exploited by attackers to cause a denial of service...

Vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are caused by privilege management errors, allowing attackers to write arbitrary files to the device’s file system.

The vulnerabilities of PDF viewer programs such as Adobe Reader and Document Cloud, as well as PDF editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat, are due to privilege management errors. Exploiting these vulnerabilities can allow an attacker to remotely write arbitrary files...

Pluck Cross-Site Request Forgery Vulnerability

Pluck is a small and simple content management system CMS written in PHP. A cross-site request forgery vulnerability exists in Pluck version 4.7.10-dev2. An attacker can exploit this vulnerability to edit a page via /admin.php?action=editpage...

PT-2021-19812 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 11.10.13 XWiki Platform versions prior to 12.6.7 XWiki Platform versions prior to 12.10.2 Description: A user disabled on a wiki using email verification for registration can re-activate themselves by using th...

Unspecified Vulnerability in JetBrains Code With Me

JetBrains Code With Me is a plug-in application from the Czech company JetBrains that provides code co-editing for the IntelliJ IDE. A security vulnerability exists in JetBrains Code With Me versions prior to 2021.1. An attacker can exploit the vulnerability to open a browser on the host computer...

JetBrains Code With Me Code Execution Vulnerability

JetBrains Code With Me is a plug-in application from the Czech company JetBrains that provides code co-editing for the IntelliJ IDE. A code execution vulnerability exists in JetBrains Code With Me versions prior to 2021.1. An attacker can exploit the vulnerability to execute code in read-only mod...

Adobe Acrobat/Reader post-release reuse vulnerability (CNVD-2021-49202)

Adobe Acrobat is a PDF editing software developed by Adobe.Adobe Reader also known as Acrobat Reader is a PDF file reader developed by Adobe. Adobe Acrobat/Reader has a post-release reuse vulnerability. An attacker can exploit this vulnerability to execute arbitrary code...

Gutenberg - Critical - Access bypass - SA-CONTRIB-2021-007

This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not correctly validate access rules in certain situations allowing anonymous users to delete blocks...

Denial of service

CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular...

CVE-2021-21391

Removed by vendor...

Editing Text in a PDF File

By Uzair Amir PDF Portable Document Format is a file format developed by Adobe Systems that provides an electronic display of information such as documents, presentations, etc. This is a post from HackRead.com Read the original post: Editing Text in a PDF File...

Any logged in user could edit any other logged in user.

Impact Everyone who is running a12n-server. A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patches Patched in v0.18.2...

Insecure Access Controls

@curveball/a12n-server uses insecure access controls. Inadequate permissiosn check allows any authenticated user to perform unauthorized editting of other users' information...