14142 matches found
Novel-Plus SQL Injection Vulnerability
Novel-Plus is an online social reading and writing platform from Novel-Plus, Inc. An SQL injection vulnerability exists in Novel-Plus version 4.3.0-RC1, which stems from the fact that incorrect manipulation of the parameter sort can lead to sql injection...
CVE-2024-0941: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Novel-Plus 4.3.0-RC1 and classified as critical. This issue affects some unknown processing of the file /novel/bookComment/list. The manipulation of the argument sort leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier...
PT-2024-15925
Name of the Vulnerable Software and Affected Versions Novel-Plus version 4.3.0-RC1 Description A critical issue affects the processing of the file /novel/bookComment/list. The manipulation of the argument sort leads to SQL injection. Recommendations For Novel-Plus version 4.3.0-RC1, consider...
CVE-2023-50785
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
CVE-2023-50785
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
CVE-2023-50785
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
Path traversal
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
ZOHO ManageEngine ADAudit Plus security vulnerabilities
ZOHO ManageEngine ADAudit Plus is ZOHO's solution for simplifying audits, proving compliance and detecting threats. A directory traversal vulnerability exists in ZOHO ManageEngine ADAudit Plus prior to version 7270, which can be exploited by an attacker to view the name of an arbitrary directory...
CVE-2023-50785
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
CVE-2023-50785
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
CVE-2023-50785: Improper Limitation of a Pathname to a Restricted Directory
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
CVE-2023-50785
The issue concerns Zoho ManageEngine ADAudit Plus prior to build 7270, which is affected by a directory traversal vulnerability that allows admin users to view names of arbitrary directories outside the designated installation directory. The root cause is path traversal (no exploitation details p...
ManageEngine ServiceDesk Plus MSP < 14.5 Build 14504 XSS
The version of ManageEngine ServiceDesk Plus MSP installed on the remote host is prior to 14.5 Build 14504. It is, therefore, affected by a stored cross-site scripting XSS vulnerability that allows a low-privileged technician to inject malicious JavaScript into the task's name when creating a tim...
PT-2024-1428 · Zoho · Zoho Manageengine Adaudit Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions prior to 7270 Description: The issue is related to incorrect restriction of directory path names with limited access, allowing admin users to view names of arbitrary directories via path traversal. This...
cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +2 more potentially affected by CVE-2024-22497 via com.jfinal:jfinal (1.4)
com.jfinal:jfinal MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =1.0.10, =1.0.11 - com.jfinal:jfinal-ext 3.0.1 Source cves: CVE-2024-22497 Source...
cc.ecore:spring-jfinal-plugin (>=0.1.0, <=0.1.2), cc.ecore:spring-jfinal-plus (>=0.1.1, <=0.1.2) +2 more potentially affected by CVE-2024-22496 via com.jfinal:jfinal (1.4)
com.jfinal:jfinal MAVEN version 1.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.jfinal:jfinal and may be impacted: - cc.ecore:spring-jfinal-plugin =0.1.0, =0.1.1, =1.0.10, =1.0.11 - com.jfinal:jfinal-ext 3.0.1 Source cves: CVE-2024-22496 Source...
VulnCheck KEV: CVE-2021-24290
There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages...
CVE-2021-31314
File upload vulnerability in ejinshan v8+ terminal security system allows attackers to upload arbitrary files to arbitrary locations on the server...
BA Plus <= 1.0.3 - Reflected Cross-Site Scripting
Description The BA Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...