CVE-2022-0277 Incorrect Permission Assignment for Critical Resource in microweber/microweber

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0277 Incorrect Permission Assignment for Critical Resource in microweber/microweber

Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0266

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v...

Authorization

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v...

CVE-2022-0266

CVE-2022-0266 affects livehelperchat (Packagist remdex/livehelperchat) prior to version 3.92. The vulnerability is described as an authorization bypass via a user-controlled key. Multiple connected sources (OSV, CNVD/CNNVD, NVD, CVE lists) consistently reference the same issue and suggest upgradi...

CVE-2022-0266 Authorization Bypass Through User-Controlled Key in livehelperchat/livehelperchat

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v...

CVE-2022-0266 Authorization Bypass Through User-Controlled Key in livehelperchat/livehelperchat

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v...

CVE-2022-0263

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7...

CVE-2022-0262

Cross-site Scripting XSS - Stored in Packagist pimcore/pimcore prior to 10.2.7...

CVE-2022-0263

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7...

Cross site scripting

Cross-site Scripting XSS - Stored in Packagist pimcore/pimcore prior to 10.2.7...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7...

CVE-2022-0263 Unrestricted Upload of File with Dangerous Type in pimcore/pimcore

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7...

CVE-2022-0263

CVE-2022-0263 relates to pimcore/pimcore prior to 10.2.7, where there is an unrestricted upload of dangerous file types via the file upload feature. The root cause is lack of validation/sanitation for uploaded file types, enabling attackers to upload malicious files. Reported impact includes high...

CVE-2022-0262 Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting XSS - Stored in Packagist pimcore/pimcore prior to 10.2.7...

CVE-2022-0262

CVE-2022-0262 is a stored Cross-site Scripting (XSS) vulnerability in Pimcore’s Packagist package pimcore/pimcore prior to version 10.2.7. The issue stems from insufficient validation of client-side data, allowing injected JavaScript to execute in a user’s browser. Affected products are Pimcore (...

CVE-2022-0262 Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting XSS - Stored in Packagist pimcore/pimcore prior to 10.2.7...

GHSA-H5H8-PC6H-JVVX Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial

URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow commands to be executed in the HgDriver if hg/Mercurial is installed on the system. Impact - The impact to Composer users directly is limit...

Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial

URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow commands to be executed in the HgDriver if hg/Mercurial is installed on the system. Impact - The impact to Composer users directly is limit...

Cross-Site Scripting in Bootstrap Package

Problem It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. The following templates are affected by the vulnerability:...