4784 matches found
CVE-2020-36321
Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder...
CVE-2021-31410
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request...
Project sources exposure in Vaadin Designer
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request. See CWE-402: Transmission of Private Resources into a New Sphere 'Resource Leak' Affected products and mitigation...
GHSA-49R2-73M6-PP8F Directory traversal in development mode handler in Vaadin 14 and 15-17
Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder. -...
GHSA-82MF-MMH7-HXP5 Directory traversal in development mode handler in Vaadin 14 and 15-17
Improper URL validation in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.4.1 Vaadin 14.0.0 through 14.4.2, and 3.0 prior to 5.0 Vaadin 15 prior to 18 allows attacker to request arbitrary files stored outside of intended frontend resources folder. -...
SQL Injection Vulnerability in CSCMS Frontend
cscms is a diversified content management system, using PHP5 MYSQL as the technical basis for development, using OOP object-oriented approach to the basic operation of the framework to build. CSCMS front-end SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive...
DEBIAN-CVE-2021-30184
GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN Portable Game Notation data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmdpgnload and cmdpgnreplay functions in frontend/cmd.cc...
UBUNTU-CVE-2021-30184
GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN Portable Game Notation data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmdpgnload and cmdpgnreplay functions in frontend/cmd.cc...
XSS Vulnerability in Heybbs Frontend
HEYBBS Micro Community is a bootstrap+php+mysqli based development program. Heybbs frontend has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...
HackerOne: The possibility of disrupting the normal operation of frontend using markdown
Summary: Hi team, Our team noticed that using some string construction in markdown may cause it to fail and output error 502. Thus, disrupting the UI process. This may affect the work in places where there is a GraphQL attribute output. For example: User object in GraphQL : introhtml attribute...
XSS vulnerability in Hsycms frontend (CNVD-2021-26061)
Hsycms is a rapid site building system developed by TP5.0 framework. Hsycms has an XSS vulnerability in the frontend. An attacker can exploit the vulnerability to obtain an administrator cookie...
SQL Injection Vulnerability in xdcms Frontend
xdcms is an open source, general purpose content management system. A SQL injection vulnerability exists in the frontend of xdcms, which can be exploited by attackers to obtain sensitive database information...
Cross site scripting
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...
CVE-2021-24147 Modern Events Calendar Lite < 5.16.5 - Authenticated Stored Cross-Site Scripting (XSS)
Unvalidated input and lack of output encoding in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not sanitise the miccomment field Notes on time when adding/editing an event, allowing users with privilege as low as author to add events with a Cross-Site Scripting...
SQL Injection Vulnerability in Ke361 Frontend Go*** Functions
Ke361 is an open source Taobao system. Ke361 front-end Go function has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database data...
Wordpress Photo Gallery SQL注入漏洞
Wordpress Photo Gallery is Wordpress open source an application plugin . It provides a feature to add responsive galleries and photo albums to a website. A SQL injection vulnerability exists in the WordPress Photo Gallery plugin, which originates from the frontend/models/model.php bwgsearchx...
SQL Injection Vulnerability in Ke361 Frontend Ho*** Functions
Ke361 is an open source Taobao system. Ke361 front-end Ho function SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive database data...
XSS vulnerability in 115cms frontend (CNVD-2021-28389)
115CMS is developed using the current most popular ThinkPHP framework, which is an efficient and open source content management system. 115cms frontend has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...