HTTP Request Smuggling

squid3 is vulnerable to HTTP request smuggling. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between a client and Squid with attacker-controlled content ...

SQL Injection Vulnerability in Aj***.ashx File of CMS Web Publishing System of Nanjing Yu Hou Network Technology Co.

Nanjing Yu Hou Network Technology Co., Ltd. is a provider and successful practitioner of regional education informatization and school wisdom education solutions, has provided education informatization software system development and services for a number of cities, districts and schools. A SQL...

ZZCMS 2020 Frontend SQL Injection Vulnerability

ZZCMS is a content management system for Webmaster Merchants. A SQL injection vulnerability exists in the ZZCMS 2020 frontend, which can be exploited by attackers to obtain sensitive information from the database...

@knonginda/base (>=1.0.3, <=1.0.27), cneport-core-frontend (>=1.0.40, <=1.0.59) +3 more potentially affected by unknown CVE via vue-moment (4.0.0)

vue-moment NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vue-moment and may be impacted: - @knonginda/base =1.0.3, =1.0.40, =1.0.1, =1.0.48, =1.0.9, =1.2.37 Source cves: unknown CVE Source advisory: OSV:GHSA-HRPP-F84W-XHFG...

@0negativ/hawtio-integration (>=4.13.7-rc4, <=4.13.7-rc5), @atlasmap/atlasmap.data.mapper (>=1.32.0-SNAPSHOT.20180129121405, <=1.34.0-SNAPSHOT.20180420142818) +105 more potentially affected by CVE-2019-20921 via bootstrap-select (>=1.7.3, <=1.13.5)

bootstrap-select NPM version =1.7.3, =4.13.7-rc4, =1.32.0-SNAPSHOT.20180129121405, =1.0.0, =2.0.0, =1.0.0, =1.0.0, =3.2.13, =3.0.11, =3.0.1, =3.0.7, =3.2.17, =5.4.1 and more Source cves: CVE-2019-20921 Source advisory: OSV:GHSA-9R7H-6639-V5MW...

norska (>=0.7.0, <=0.8.4), norska-frontend (>=0.7.4, <=0.9.11) +5 more potentially affected by unknown CVE via lazysizes (>=5.1.1, <=5.2.0)

lazysizes NPM version =5.1.1, =0.7.0, =0.7.4, =0.7.4, =2.1.4, =0.5.2, =0.5.2, =0.7.2 - sov 0.2.4 Source cves: unknown CVE Source advisory: OSV:GHSA-W4VP-3MQ7-7V82...

Dropcontact: User registration using public domain email like gmail in place of professional email.

Like sais in the title, we were only checking and restricting professional email in frontend, which led to being able to register with an email which is not pro because we were not checking this info in the backend. User was able to register with public domain email like gmail by response...

CVE-2020-12606

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...

Sql injection

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...

SQL Injection Vulnerability in Ejucms Frontend of Hainan Ejucms Technology Co. Ltd (CNVD-2020-50722)

Ejucms Real Estate System Ejucms is a localized O2O real estate website platform system. Ltd. Ejucms front-end SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive database information...

Stored Cross-Site Scripting Vulnerability in RGCMS Frontend In***.php File

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS front In.php file exists stored cross-site scripting vulnerability. Attackers can use this...

Improper Input Validation

Overview solidusfrontend is a cart and storefront for the Solidus e-commerce project. Affected versions of this package are vulnerable to Improper Input Validation. It allows a malicious customer to craft request data with parameters that allow changing the address of the current order without...

SQL Injection Vulnerability in Dascommerce Mall System v2.0 Frontend

Big business mall system is a business creation network based on ten years of reconstruction of the e-commerce architecture, to create a set of operators, suppliers, purchasers, user distribution, etc., in the PC and mobile devices can be compatible with the operation of a complete set of offline...

Insecure defaults in UmbracoForms

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

GHSA-8M73-W2R2-6XXJ Insecure defaults in UmbracoForms

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

Hostmaster (Aegir) - Moderately critical - Access bypass, Arbitrary code execution - SA-CONTRIB-2020-031

Aegir is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. Given that Aegir can use both Apache and Nginx Web servers, Apache allows configuration-writing users to escalate their privileges to the superuser root, and Aegir's operations...

CVE-2020-7685

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

Default configuration

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

CVE-2020-7685 Insecure Defaults

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

CVE-2020-7685

CVE-2020-7685 affects UmbracoForms (all versions). The issue arises when using the default configuration for file uploads, which permits uploading arbitrary file types. A mitigation path is described: implement a custom workflow and frontend validation to block disallowed file types according to ...