Dropcontact: User registration using public domain email like gmail in place of professional email.

Like sais in the title, we were only checking and restricting professional email in frontend, which led to being able to register with an email which is not pro because we were not checking this info in the backend. User was able to register with public domain email like gmail by response...

CVE-2020-12606

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...

Sql injection

An issue was discovered in DB Soft SGLAC before 20.05.001. The ProcedimientoGenerico method in the SVCManejador.svc webservice of the SGLAC web frontend allows an attacker to run arbitrary SQL commands on the SQL Server. Command execution can be easily achieved by using the xpcmdshell stored...

SQL Injection Vulnerability in Ejucms Frontend of Hainan Ejucms Technology Co. Ltd (CNVD-2020-50722)

Ejucms Real Estate System Ejucms is a localized O2O real estate website platform system. Ltd. Ejucms front-end SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive database information...

Stored Cross-Site Scripting Vulnerability in RGCMS Frontend In***.php File

RuiGu information management system RGCMS is a set of open source building management system, using PHP language, written in the framework of Thinkphp5.1.+, the database using MYSQL database. RGCMS front In.php file exists stored cross-site scripting vulnerability. Attackers can use this...

Improper Input Validation

Overview solidusfrontend is a cart and storefront for the Solidus e-commerce project. Affected versions of this package are vulnerable to Improper Input Validation. It allows a malicious customer to craft request data with parameters that allow changing the address of the current order without...

Exploit for Improper Handling of Exceptional Conditions in Google Android

Analysis of CVE-2020-0108: Vulnerability Exploitation by Eleva...

SQL Injection Vulnerability in Dascommerce Mall System v2.0 Frontend

Big business mall system is a business creation network based on ten years of reconstruction of the e-commerce architecture, to create a set of operators, suppliers, purchasers, user distribution, etc., in the PC and mobile devices can be compatible with the operation of a complete set of offline...

Insecure defaults in UmbracoForms

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

GHSA-8M73-W2R2-6XXJ Insecure defaults in UmbracoForms

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

Hostmaster (Aegir) - Moderately critical - Access bypass, Arbitrary code execution - SA-CONTRIB-2020-031

Aegir is a powerful hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. Given that Aegir can use both Apache and Nginx Web servers, Apache allows configuration-writing users to escalate their privileges to the superuser root, and Aegir's operations...

CVE-2020-7685

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

Default configuration

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

CVE-2020-7685 Insecure Defaults

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that...

CVE-2020-7685

CVE-2020-7685 affects UmbracoForms (all versions). The issue arises when using the default configuration for file uploads, which permits uploading arbitrary file types. A mitigation path is described: implement a custom workflow and frontend validation to block disallowed file types according to ...

[SECURITY] Fedora 31 Update: zabbix-4.0.22-1.fc31

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

PT-2020-19708 · Umbraco · Umbraco Forms

Name of the Vulnerable Software and Affected Versions: UmbracoForms versions all versions Description: The issue allows uploading arbitrary file types when using the default configuration for upload forms. Users can mitigate this by creating a custom workflow and frontend validation to block...

[SECURITY] Fedora 32 Update: cacti-1.2.13-1.fc32

Cacti is a complete frontend to RRDTool. It stores all of the necessary information to create graphs and populate them with data in a MySQL database. The frontend is completely PHP driven...

Stored cross-site scripting vulnerability in hybbs frontend fr***.js file

hybbs is a PHP web program that supports plugin extensions and template extensions. A stored cross-site scripting vulnerability exists in the frontend fr.js file of hybbs. Attackers can use the vulnerability to obtain sensitive information such as user cookies...

SQL Injection Vulnerability in kkcms Frontend

kkcms is an open source video capture and playback system . The system is mainly used to automatically capture film and television resources and provide online playback capabilities. kkcms front-end SQL injection vulnerability. Attackers can use the vulnerability to obtain sensitive information i...