Pimcore 跨站脚本漏洞

Pimcore is Austria Pimcore company's set of open source for creating and managing Web applications Web content management platform. The platform integrates Web content management, e-commerce framework and product information management applications. A cross-site scripting vulnerability exists in...

GHSA-7R35-CHV4-XR3R Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.20 or apply this patch manually...

Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.20 or apply this patch manually...

Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.20 or apply this patch manually...

Duplicate Advisory: Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r35-chv4-xr3r. This link is maintained ot preserve external references. Original Description Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20...

GHSA-6MMF-QM37-PMGG Duplicate Advisory: Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r35-chv4-xr3r. This link is maintained ot preserve external references. Original Description Cross-site Scripting XSS - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20...

GHSA-69FC-V223-6RJW Duplicate Advisory: Pimcore Cross-site scripting in Predefined Asset Metadata module in Settings

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6qjm-39vh-729w. This link is maintained ot preserve external references. Original Description Cross-site Scripting XSS - Generic in GitHub repository pimcore/pimcore prior to 10.5.20...

Stored XSS via name parameter of "Predefined Properties"

Description It's observed that the name parameter of the "Predefined Properties" functionality is vulnerable to stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Settings - Predefined Properties - Add and Enter the payload: " inside the name input field. 3.Then...

Multiple Stored XSS in name parameter of "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes"

Description The name parameter of the "Pricing Rules", "Predefined Properties", "Customers Reports" & "Static Routes" functionality is vulnerable to Stored XSS. Proof of Concept 1.Login to https://demo.pimcore.fun/admin/. 2.Now go to Online Shop - Pricing Rules - Add and Enter the name of the new...

XSS in Predefined Asset Metadata module in Settings

Description While testing the pimcore application, I found that it is vulnerable to XSS vulnerability in Predefined Asset Metadata module in Settings, specifically at Name field. Proof of Concept 1.Go to https://11.x-dev.pimcore.fun/admin/ then login. 2.Go to Settings - Predefined Asset Metadata...

Reflected XSS in Predefined Properties module in Settings

Description During testing the pimcore application, I found that it is vulnerable to XSS vulnerability in Predefined Properties module in Settings, specifically at Name field. Proof of Concept 1.Go to https://11.x-dev.pimcore.fun/admin/ then login. 2.Go to Settings - Predefined Properties and add...

SUSE CVE-2008-4409

libxml2 2.7.0 and 2.7.1 does not properly handle "predefined entities definitions" in entities, which allows context-dependent attackers to cause a denial of service memory consumption and application crash, as demonstrated by use of xmllint on a certain XML document, a different vulnerability th...

SUSE CVE-2009-2475

Sun Java SE 5.0 before Update 20 and 6 before Update 15, and OpenJDK, might allow context-dependent attackers to obtain sensitive information via vectors involving static variables that are declared without the final keyword, related to 1 LayoutQueue, 2 Cursor.predefined, 3...

SUSE CVE-2022-40626

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...

UBUNTU-CVE-2022-40626

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...

CVE-2022-40626

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...

CVE-2022-35582

Penta Security Systems Inc WAPPLES 4.0., 5.0.0., 5.0.12. are vulnerable to Incorrect Access Control. The operating system that WAPPLES runs on has a built-in non-privileged user penta with a predefined password. The password for this user, as well as its existence, is not disclosed in the...

The vulnerability of the /etc/shadow.sample component of the TOTOLINK A810R router’s microprogramming system allows a intruder to gain increased privileges.

The vulnerability of the /etc/shadow.sample component of the TOTOLINK A810R router’s software lies in the use of pre-set user accounts. Exploiting this vulnerability could allow an attacker to gain increased privileges remotely...

CVE-2022-40626

An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...

LDAP Query and Enumeration Module

This module allows users to query an LDAP server using either a custom LDAP query, or a set of LDAP queries under a specific category. Users can also specify a JSON or YAML file containing custom queries to be executed using the RUNQUERYFILE action. If this action is specified, then QUERYFILEPATH...