OpenClinic GA 安全漏洞

OpenClinic GA is an open source hospital information management system. The system supports financial management, clinical management and laboratory management. A security vulnerability exists in OpenClinic GA, which stems from the fact that by default, the Authenticated Users group has permissio...

Gestionale Open 11.00.00 Privilege Escalation

Exploit Title: Gestionale Open 11.00.00 - Local Privilege Escalation Date: 2021-07-19 Author: Alessandro 'mindsflee' Salzano Vendor Homepage: https://www.gestionaleopen.org/ Software Homepage: https://www.gestionaleopen.org/ Software Link:...

Gestionale Open 11.00.00 - Local Privilege Escalation Vulnerability

Exploit Title: Gestionale Open 11.00.00 - Local Privilege Escalation Author: Alessandro 'mindsflee' Salzano Vendor Homepage: https://www.gestionaleopen.org/ Software Homepage: https://www.gestionaleopen.org/ Software Link:...

CVE-2020-23039

Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting XSS vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name...

CVE-2020-23039

Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting XSS vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name...

Cross site scripting

Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting XSS vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name...

CVE-2020-23039

CVE-2020-23039 concerns Folder Lock v3.4.5, where a stored XSS vulnerability exists in the Create Folder function (Create module). The underlying issue is lack of data validation/filtering for user-supplied data in folder names/paths, allowing an attacker to inject arbitrary web scripts or HTML t...

CVE-2020-23039

Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting XSS vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name...

CVE-2021-42542

The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure...

CVE-2021-30359

The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Installer allows regular users to repair their installation, an attacker running an installer before 90.08.7405 can start the installation...

CVE-2021-42540

The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality...

CVE-2021-42542

The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure...

Code injection

The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality...

Directory traversal

The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure...

CVE-2021-42542

CVE-2021-42542 affects Emerson WirelessHART Gateway devices, where a directory traversal flaw stems from mishandling the structure of the supplied backup folder during restore. Public sources (NVD, CVE record, and ICS advisory) assign a CVSSv3 base score of 8.0 (high) and note remote exploitation...

CVE-2021-42542 Emerson WirelessHART Gateway

The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure...

CVE-2021-42540 Emerson WirelessHART Gateway

The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality...

CVE-2021-38465

The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating large amounts of installations, which are then saved without limitation in the temp folder of the webinstaller executable...

CVE-2021-38465

The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating large amounts of installations, which are then saved without limitation in the temp folder of the webinstaller executable...

Design/Logic Flaw

The webinstaller is a Golang web server executable that enables the generation of an Auvesy image agent. Resource consumption can be achieved by generating large amounts of installations, which are then saved without limitation in the temp folder of the webinstaller executable...