4587 matches found
AML Surety Eco 安全漏洞
AML Surety Eco is an end-to-end BSA/AML ecosystem from AML. A security vulnerability exists in AML Surety Eco version 3.5 and earlier, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to run arbitrary code via a specially crafted GET request...
CVE-2024-39304 ChurchCRM SQL Injection Vulnerability
ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQ...
CVE-2024-31979
Server-Side Request Forgery SSRF vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an...
CVE-2024-31979: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in Apache StreamPipes during installation process of pipeline elements. Previously, StreamPipes allowed users to configure custom endpoints from which to install additional pipeline elements. These endpoints were not properly validated, allowing an...
CVE-2024-6746
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...
CVE-2024-6746 NaiboWang EasySpider HTTP GET Request server.js path traversal
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...
CVE-2024-6746 NaiboWang EasySpider HTTP GET Request server.js path traversal
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...
CVE-2024-6746
NaiboWang EasySpider 0.6.2 on Windows has a path-traversal vulnerability in the HTTP GET Request Handler (server.js) that allows reading arbitrary Windows files via input like /../../../../../../../../../Windows/win.ini. Exploitation is possible within a local network, and public disclosure has o...
CVE-2024-6746 NaiboWang EasySpider HTTP GET Request server.js path traversal
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...
CVE-2024-6746: Path Traversal: '../filedir'
A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...
BIT-MEDIAWIKI-2024-40603
An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request...
CVE-2024-39063
Lime Survey = 6.5.12 is vulnerable to Cross Site Request Forgery CSRF. The YIICSRFTOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests...
Fortinet FortiAIOps 跨站请求伪造漏洞
Fortinet FortiAIOps is a Fortinet networking solution that combines artificial intelligence and machine learning AI/ML from Fortinet. Fortinet FortiAIOps version 2.0.0 suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that...
CVE-2024-39063
Lime Survey = 6.5.12 is vulnerable to Cross Site Request Forgery CSRF. The YIICSRFTOKEN is only checked when passed in the body of POST requests, but the same check isn't performed in the equivalent GET requests...
CVE-2024-40603
An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request...
CVE-2024-40603: Cross-Site Request Forgery (CSRF)
An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request...
MediaWiki 安全漏洞
MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. It can be used to deploy in-house knowledge management and content management systems. MediaWiki has a security vulnerability that stems from the presence of cross-site request forgery CSRF,...
CVE-2024-40603
An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request...
CVE-2024-40603
CVE-2024-40603 affects the MediaWiki ArticleRatings extension up to 1.42.1. The vulnerability is in Special:ChangeRating, where CSRF can alter data via a GET request. Underlying cause: CSRF weakness in the GET-based operation. Impact: data modification is possible, with CVSS 3.1 base score 4.3 (M...