Sql injection

AbanteCart 1.2.8 allows SQL Injection via the sourcelanguage parameter to admin/controller/pages/localisation/language.php and core/lib/languagemanager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php...

PT-2019-7551

Name of the Vulnerable Software and Affected Versions AbanteCart version 1.2.8 Description The issue allows SQL Injection via the source language parameter to admin/controller/pages/localisation/language.php and core/lib/language manager.php, or via POST data to...

PT-2019-7553

Name of the Vulnerable Software and Affected Versions Redaxo version 5.2.0 Description The issue affects the cron management in the admin panel, where a CSRF vulnerability can lead to arbitrary Remote Code Execution. This is achieved through the addons/cronjob/lib/types/phpcode.php file...

CVE-2016-10757: Cross-Site Request Forgery (CSRF)

In Redaxo 5.2.0, the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php...

CVE-2018-17181

An issue was discovered in OpenEMR before 5.0.1 Patch 7. SQL Injection exists in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php...

CVE-2018-17180

An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/downloadtemplate.php...

PT-2019-9405

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1 Patch 7 Description An issue exists where Directory Traversal is possible, allowing access to files outside the intended directory. This is achieved by manipulating the docid parameter with a value such as ../ i...

PT-2019-9406

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1 Patch 7 Description An issue exists in the software, where SQL Injection is present in the SaveAudit function in /portal/lib/paylib.php and the portalAudit function in /portal/lib/appsql.class.php. Recommendatio...

CVE-2018-17180: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in OpenEMR before 5.0.1 Patch 7. Directory Traversal exists via docid=../ to /portal/lib/downloadtemplate.php...

Sql injection

admin/Lib/Action/FpluginAction.class.php in FDCMS aka Fangfa Content Manage System 4.2 allows SQL Injection...

PT-2019-9390

Name of the Vulnerable Software and Affected Versions FDCMS version 4.2 Description The issue allows SQL Injection in FDCMS. This is due to a problem in the admin/Lib/Action/FpluginAction.class.php file. Recommendations For FDCMS version 4.2, update to a newer version that contains a fix for this...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12098: Improper Certificate Validation

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5initcredsstep in lib/krb5/initcredspw.c...

CVE-2019-12043

CVE-2019-12043 affects remarkable 1.7.1. The vulnerability is in lib/parser_inline.js, where URL filtering is mishandled, allowing cross-site scripting via unprintable characters (demonstrated by a \x0ejavascript: URL). Documents in Red Hat, GHSA and OSV/EUVD Veracode references confirm the XSS i...

CVE-2019-12043

In remarkable 1.7.1, lib/parserinline.js mishandles URL filtering, which allows attackers to trigger XSS via unprintable characters, as demonstrated by a \x0ejavascript: URL...

CVE-2019-12041

lib/common/htmlre.js in remarkable 1.7.1 allows Regular Expression Denial of Service ReDoS via a CDATA section...

PT-2019-12631

Name of the Vulnerable Software and Affected Versions Remarkable version 1.7.1 Description The issue arises from the mishandling of URL filtering in the lib/parser inline.js file, allowing attackers to trigger XSS via unprintable characters. This can be demonstrated by a x0ejavascript: URL, which...