Security Misconfiguration in Frontend Session Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-018...

Security Misconfiguration in Frontend Session Handling

It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data...

SQL Injection Vulnerability in YouDianCMS v8.0 Frontend

Youdiancms Enterprise Website Management System is an enterprise website building system developed by Changsha Youdian Software Technology Co. YouDianCMS v8.0 has a SQL injection vulnerability in the frontend, which can be exploited by attackers to obtain sensitive information from the database...

DEBIAN-CVE-2019-12497

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents e.g., Name and mail address can be disclosed in external notes...

CVE-2019-12497

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents e.g., Name and mail address can be disclosed in external notes...

CVE-2019-12497: Exposure of Sensitive Information to an Unauthorized Actor

An issue was discovered in Open Ticket Request System OTRS 7.0.x through 7.0.8, Community Edition 6.0.x through 6.0.19, and Community Edition 5.0.x through 5.0.36. In the customer or external frontend, personal information of agents e.g., Name and mail address can be disclosed in external notes...

SQL Injection Vulnerability in the Frontend of Environmental Times Enterprise Online Bookkeeping Management System

Eco Times Business Online Bookkeeping Management System is a simple and easy to use bookkeeping system for micro and small businesses and households. SQL injection vulnerability exists in the frontend of the EcoTimes Enterprise Online Bookkeeping Management System, which can be exploited by...

PT-2019-12826 · Otrs +2 · Otrs +2

Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 7.0.x through 7.0.8 Open Ticket Request System OTRS Community Edition versions 6.0.x through 6.0.19 Open Ticket Request System OTRS Community Edition versions 5.0.x through 5.0.36 Description: An issue...

PHPOK Enterprise Building System v5.2.116 SQL Injection Vulnerability in Frontend

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK Enterprise Station Building System v5.2.116 has a SQL injection vulnerability in the frontend. An attacker can exploit this vulnerability to obtain sensitive database information...

xss vulnerability in jeeweb frontend

JeeWeb is an agile development system based on SpringBoot 2+Spring+Mybatis+Hibernate An xss vulnerability exists in the frontend of jeeweb, which can be exploited by an attacker to obtain an administrator cookie...

Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...

Storage-based Cross-site Scripting Vulnerability in the Frontend of Feifei Movie Navigation System

FeiFeiCms is developed by PHP+Mysql technology and can run on windows and Linux system platform. A stored cross-site scripting vulnerability exists in the frontend of FeiFeiCms. Attackers can insert malicious js code into the page to obtain user cookies and other information, resulting in user...

SQL Injection Vulnerability in dhcms Frontend

dhcms is an enterprise building system. A SQL injection vulnerability exists in the frontend of dhcms, which can be exploited by attackers to obtain sensitive database information...

CVE-2019-11445: Unrestricted Upload of File with Dangerous Type

OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site, via frontend/FileUpload and admin/repositoryexport.jsp. This is achieved by interfering with the Filesystem path control in the admin's...

PT-2019-12310

Name of the Vulnerable Software and Affected Versions OpenKM versions 6.3.2 through 6.3.7 Description The issue allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site. This is achieved by exploiting the Filesystem path...

PHPOK enterprise website builder system has SQL injection vulnerability

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. A SQL injection vulnerability exists in the frontend of PHPOK Enterprise CMS version 5.2.060. An attacker can exploit this vulnerability to obtain sensitive database information...

Stored cross-site scripting vulnerability in JYmusic frontend (CNVD-2019-13271)

JYmusic is an open source cross-platform music management system. JYmusic frontend has a stored cross-site scripting vulnerability, an attacker can insert malicious js code in the page to obtain user cookies and other information, resulting in user hijacking...

Stored cross-site scripting vulnerability in JYmusic frontend (CNVD-2019-13272)

JYmusic is an open source cross-platform music management system. JYmusic frontend has a stored cross-site scripting vulnerability, an attacker can insert malicious js code in the page to obtain user cookies and other information, resulting in user hijacking...

Stored cross-site scripting vulnerability in JYmusic frontend (CNVD-2019-13273)

JYmusic is an open source cross-platform music management system. JYmusic frontend has a stored cross-site scripting vulnerability, an attacker can insert malicious js code in the page to obtain user cookies and other information, resulting in user hijacking...

Stored Cross-Site Scripting Vulnerability in JYmusic Frontend

JYmusic is an open source cross-platform music management system. JYmusic frontend has a stored cross-site scripting vulnerability, an attacker can insert malicious js code in the page to obtain user cookies and other information, resulting in user hijacking...