443 matches found
CVE-2020-19527
iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DBNAME parameter to install/install.php...
CVE-2020-19527
iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DBNAME parameter to install/install.php...
PT-2020-15168
Name of the Vulnerable Software and Affected Versions iCMS version 7 Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the DB PREFIX parameter to install/install.php. This enables them to potentially install malicious software or perform other...
PT-2020-15188
Name of the Vulnerable Software and Affected Versions iCMS version 7.0.14 Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the DB NAME parameter to the "install/install.php" endpoint. This can potentially lead to the installation of malicious...
CVE-2020-19527: Improper Neutralization of Special Elements used in an OS Command
iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DBNAME parameter to install/install.php...
CVE-2020-19142: Improper Neutralization of Special Elements used in an OS Command
iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DBPREFIX parameter to install/install.php...
idreamsoft iCMS Operating System Command Injection Vulnerability
idreamsoft iCMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in iCMS 7.0.14, which can be exploited by an attacker to install.php by executing arbitrary OS commands via shell metacharacters in the DB NAME parameter...
CVE-2020-15177
In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication i...
CVE-2020-15177
GLPI prior to 9.5.2 is vulnerable due to install/install.php storing user input into url_base/url_base_api, enabling XSS and insecure redirection without authentication; patch to 9.5.2 or later.
CVE-2020-15177: Improper Neutralization of Input During Web Page Generation
In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure Redirection Since authentication i...
glpi -- Unauthenticated Stored XSS
MITRE Corporation reports: In GLPI before version 9.5.2, the install/install.php endpoint insecurely stores user input into the database as urlbase and urlbaseapi. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting and Insecure...
Drupal 7.x < 7.69 Multiple Vulnerabilities
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - The Drupal project uses the third-party library ArchiveTar, which has released a security update that impacts some Drupal configurations. Multiple vulnerabilities are possibl...
Drupal 8.7.x < 8.7.11 Multiple Vulnerabilities
According to its self-reported version number, the detected Drupal application is affected by multiple vulnerabilities : - The Drupal project uses the third-party library ArchiveTar, which has released a security update that impacts some Drupal configurations. Multiple vulnerabilities are possibl...
Drupal 7.0.x < 7.69 / 8.7.x < 8.7.11 / 8.8.x < 8.8.1 Multiple Vulnerabilities (drupal-2019-12-18)
According to its self-reported version, the instance of Drupal running on the remote web server is 7.0.x prior to 7.69, 8.7.x prior to 8.7.11, or 8.8.x prior to 8.8.1. It is, therefore, affected by multiple vulnerabilities. - The Drupal project uses the third-party library ArchiveTar, which has...
DRUPAL-CORE-2019-009
A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt...
PT-2019-20551
A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt...
Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt...
Missing warning can lead to unauthenticated admin access in SilverStripe
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...
GHSA-CG8J-8W52-735V Missing warning can lead to unauthenticated admin access in SilverStripe
In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access...
