13411 matches found
CVE-2019-16664
ThinkSAAS 2.91 is affected by CVE-2019-16664: an XSS via the parameter groupname in index.php?app=group&ac=create&ts=do. Root cause described across sources is insufficient sanitization of the groupname input, enabling cross-site scripting. Affected product/version: ThinkSAAS 2.91. The Red Hat ad...
CVE-2019-16658
TuziCMS 2.0.6 is affected by a CSRF vulnerability in the endpoint index.php/manage/notice/do_add . The provided documents identify the root cause as a CSRF issue at that endpoint. No exploitation specifics or remediation steps are given in the sources. If present, check for interim mitigations; o...
CVE-2019-16659
The connected sources confirm CVE-2019-16659 affects TuziCMS 2.0.6, describing a CSRF issue in index.php/manage/link/do_add. The root cause is a Cross-Site Request Forgery vulnerability in that endpoint, enabling unauthorized state-changing requests from a logged-in user. Exploit details, affecte...
CVE-2019-16664: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter...
CVE-2019-16658: Cross-Site Request Forgery (CSRF)
TuziCMS 2.0.6 has index.php/manage/notice/doadd CSRF...
PT-2019-14750
Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered that allows for XSS via the index.php?app=group&ac=create&ts=do endpoint, specifically through the groupname parameter. Recommendations For ThinkSAAS version 2.91, consider restricting...
PT-2019-14744
Name of the Vulnerable Software and Affected Versions TuziCMS version 2.0.6 Description The issue concerns a CSRF vulnerability in the index.php/manage/link/do add endpoint. This vulnerability may allow unauthorized actions to be performed. Recommendations For TuziCMS version 2.0.6, consider...
PT-2019-14751
Name of the Vulnerable Software and Affected Versions ThinkSAAS version 2.91 Description An issue was discovered where there is a potential for XSS via the content to the "index.php?app=group&ac=comment&ts=do&js=1" URI. This can be demonstrated by a crafted SVG document in the SRC attribute of an...
PT-2019-14743
Name of the Vulnerable Software and Affected Versions TuziCMS version 2.0.6 Description The issue concerns a CSRF vulnerability in the index.php/manage/notice/do add endpoint. This allows for potential unauthorized actions. Recommendations For TuziCMS version 2.0.6, consider implementing proper...
PT-2019-14742
Name of the Vulnerable Software and Affected Versions TuziCMS version 2.0.6 Description The issue concerns an XSS vulnerability that can be triggered via the PATH INFO to a group URI. This is demonstrated by accessing index.php/article/group/id/2/, which allows for potential malicious script...
CVE-2019-16665: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...
CVE-2019-16659: Cross-Site Request Forgery (CSRF)
TuziCMS 2.0.6 has index.php/manage/link/doadd CSRF...
CVE-2019-16644
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring...
Sql injection
App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring...
CVE-2019-16642
CVE-2019-16642 affects TuziCMS 2.0.6. Affected component: App\Mobile\Controller\ZhuantiController.class.php, vulnerable to SQL injection via the index.php/Mobile/Zhuanti/group?id= parameter. Root cause described as unsafe handling of user input in ZhuantiController; impact includes data exposure ...
CVE-2019-16642: Improper Neutralization of Special Elements used in an SQL Command
App\Mobile\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Mobile/Zhuanti/group?id= substring...
PT-2019-14732
Name of the Vulnerable Software and Affected Versions TuziCMS version 2.0.6 Description The issue concerns SQL injection in TuziCMS. Specifically, it affects the index.php/Mobile/Zhuanti/group?id= endpoint, where the id parameter is vulnerable to SQL injection attacks. This could potentially allo...
CVE-2019-16644: Improper Neutralization of Special Elements used in an SQL Command
App\Home\Controller\ZhuantiController.class.php in TuziCMS 2.0.6 has SQL injection via the index.php/Zhuanti/group?id= substring...
CVE-2019-15033: Server-Side Request Forgery (SSRF)
Pydio 6.0.8 allows Authenticated SSRF during a Remote Link Feature download. An attacker can specify an intranet address in the file parameter to index.php, when sending a file to a remote server, as demonstrated by the file=http%3A%2F%2F192.168.1.2 substring...