9776 matches found
favana-docx (>=1.0.28, <=1.0.47), web-commons-export (1.2.10) potentially affected by unknown CVE via office-converter (1.0.2)
office-converter NPM version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on office-converter and may be impacted: - favana-docx =1.0.28, =1.0.47 - web-commons-export 1.2.10 Source cves: unknown CVE Source advisory: OSV:GHSA-9P64-H5Q4-PHPM...
Information Disclosure in extension "Localization Manager" (l10nmgr)
A missing access check allows an authenticated backend user to view and export data of translatable fields which are outside of the users access scope resulting in Information Disclosure...
autofair.com Cross Site Scripting vulnerability OBB-1292190
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
openbugbounty.org Cross Site Scripting vulnerability OBB-1285115
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
nusatekstile.ru Cross Site Scripting vulnerability OBB-1283241
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
biomedltravel.com Cross Site Scripting vulnerability OBB-1282456
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CloudForms: Missing access control leads to escalation of admin group privileges
A role-based privileges escalation flaw was found in Red Hat CloudForms where export or import of administrator files was possible. An attacker with EVM-Operator group can perform actions restricted only to system administrator. Refer CVE-2020-25716 for remaining RBAC group fixes...
amerysd.k12.wi.us Cross Site Scripting vulnerability OBB-1280732
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
calas.co Cross Site Scripting vulnerability OBB-1275033
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Open-Xchange: A specifically designed sieve script can cause a DoS in lib-sieve during sieve script compilation via NULL pointer dereference
Reproduction realcrash.sieve is the attached script 1. Build dovecot and pigeonhole 2. Run sievec realcrash.sieve Requirements include and variables extensions should be required. One of the global commands global/export/import without any arguments should be followed by the same command with val...
shavedbbw.com Cross Site Scripting vulnerability OBB-1274055
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-13826
A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...
Design/Logic Flaw
A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...
CVE-2020-13826
A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...
CVE-2020-1182
A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...
CVE-2020-1182
A remote code execution vulnerability exists in Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11. An attacker who successfully exploited this vulnerability could gain remote code execution via server-side script execution on the victim server. An authenticated attacke...
PT-2020-3765 · Microsoft · Dynamics 365 For Finance/Operations
Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 for Finance and Operations on-premises version 10.0.11 Description: A remote code execution issue exists, allowing an attacker to gain remote code execution via server-side script execution on the victim server. An...
CVE-2020-15947
A SQL injection vulnerability in the qmadm/qmexportstatsrun.do endpoint of Loway QueueMetrics before 19.10.21 allows remote authenticated users to execute arbitrary SQL commands via the exportId parameter...
Arbitrary File Read Vulnerability in WiseGiga NAS
Shinhan Import & Export Co., Ltd. is a Korean company that sells NAS products. An arbitrary file read vulnerability exists in WiseGiga NAS, which can be exploited by attackers to obtain sensitive information...
Input validation
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affect...