Design/Logic Flaw

Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without the appropriate privilege...

CVE-2021-20769

CVE-2021-20769 is a reported cross-site scripting vulnerability in Cybozu Garoon’s Bulletin (CWE-79). A remote authenticated attacker could inject arbitrary scripts in the context of a logged‑in user via unspecified vectors, affecting Cybozu Garoon versions 4.6.0 to 5.0.2 (and related CyVDB entri...

CVE-2021-20763

Operational restrictions bypass vulnerability in Portal of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated attacker to obtain the data of Portal without the appropriate privilege...

CVE-2021-20762

Improper input validation vulnerability in E-mail of Cybozu Garoon 4.0.0 to 5.0.2 allows a remote authenticated to alter the data of E-mail without the appropriate privilege...

CVE-2021-20759

CVE-2021-20759 affects Cybozu Garoon, specifically the Bulletin feature, where an operational restrictions bypass allows a remote authenticated attacker to alter Portal data without the proper privilege. Affected versions are Cybozu Garoon 4.6.0 through 5.0.2 (per NVD/Red Hat/JVN). The vulnerabil...

CVE-2021-20753

CVE-2021-20753 describes a cross-site scripting vulnerability in the Scheduler module of Cybozu Garoon, affecting Cybozu Garoon versions 4.0.0 through 5.0.2. The underlying issue is an input handling flaw that allows a remote authenticated attacker to inject arbitrary script via unspecified vecto...

CVE-2021-38607

Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input...

CVE-2021-38607

Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input...

Cross site scripting

Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input...

CVE-2021-21585

Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to execute arbitrary OS commands...

CVE-2021-21585

Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to execute arbitrary OS commands...

Command injection

Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to execute arbitrary OS commands...

CVE-2021-21585

CVE-2021-21585 affects Dell OpenManage Enterprise (prior to 3.6.1). The vulnerability is an OS command injection in the RACADM and IPMI tools. An authenticated remote attacker with high privileges could potentially exploit this flaw to execute arbitrary OS commands on affected systems. The issue ...

CVE-2013-4717

Multiple SQL injection vulnerabilities in Open Ticket Request System OTRS Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm,...

Cross site scripting

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search...

CVE-2013-4718

Cross-site scripting XSS vulnerability in Open Ticket Request System OTRS ITSM 3.0.x before 3.0.9, 3.1.x before 3.1.10, and 3.2.x before 3.2.7 allows remote authenticated users to inject arbitrary web script or HTML via an ITSM ConfigItem search...

CVE-2013-4717

Multiple SQL injection vulnerabilities in Open Ticket Request System OTRS Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm,...

CVE-2013-4717

CVE-2013-4717 documents multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk. Affected releases: OTRS 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9. Vulnerability arises from improper handling in modules Kernel/Output/HTML/PreferencesCustomQueue...

CVE-2021-32587

An improper access control vulnerability in FortiManager and FortiAnalyzer GUI interface 7.0.0, 6.4.5 and below, 6.2.8 and below, 6.0.11 and below, 5.6.11 and below may allow a remote and authenticated attacker with restricted user profile to retrieve the list of administrative users of other ADO...

Cross site scripting

Multiple improper neutralization of input during web page generation CWE-79 in FortiManager and FortiAnalyzer versions 7.0.0, 6.4.5 and below, 6.2.7 and below user interface, may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious paylo...