yf-exam 代码问题漏洞

yf-exam CloudFan Training Exam System is a training exam system for CleverStupidDog individual developers. A security vulnerability exists in CleverStupidDog yf-exam version 1.8.0, which stems from the lack of restriction on the suffix of uploaded files, resulting in an arbitrary file upload...

PT-2023-20048 · Unknown · Cleverstupiddog Yf-Exam

Name of the Vulnerable Software and Affected Versions: CleverStupidDog yf-exam version 1.8.0 Description: The issue concerns a lack of restriction on the suffix of uploaded files, allowing any file to be uploaded. Recommendations: For version 1.8.0, restrict access to the file upload feature unti...

PT-2023-2278 · Coredial · Sipxcom

Name of the Vulnerable Software and Affected Versions: CoreDial sipXcom versions up to and including 21.04 Description: The issue is related to Improper Neutralization of Argument Delimiters in a Command, allowing XMPP users to inject arbitrary arguments into a system command. This can be used to...

PT-2023-20661 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.0 Description: The issue allows an attacker to make the farm unusable by adding an object to a page with a huge number, filling the memory allocated to XWiki and making it unusable every time the document i...

PT-2023-16787 · WordPress · Cost Calculator

Name of the Vulnerable Software and Affected Versions: Cost Calculator plugin for WordPress versions up to, and including, 1.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping via the nd cc meta box cc price icon parameter...

PT-2023-20669 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 14.3-rc-1 through 14.4.5 XWiki Platform versions 14.9-rc-1 and earlier, excluding 14.4.6 and later Description: The issue arises from the org.xwiki.store.script.TemporaryAttachmentsScriptServiceuploadTemporaryAttachmen...

PT-2023-19417 · Jensen Of Scandinavia · Jensen Of Scandinavia Eagle 1200Ac

Name of the Vulnerable Software and Affected Versions: Jensen of Scandinavia Eagle 1200AC version 15.03.06.33 en Description: A stack overflow issue was discovered via the wepkey4 5g parameter at the "/goform/WifiBasicSet" API endpoint. Recommendations: For version 15.03.06.33 en, as a temporary...

PT-2023-19413 · Jensen Of Scandinavia · Eagle 1200Ac

Name of the Vulnerable Software and Affected Versions: Jensen of Scandinavia Eagle 1200AC version 15.03.06.33 en Description: A stack overflow issue was discovered via the ssid 5g parameter at the "/goform/WifiBasicSet" API endpoint. Recommendations: For version 15.03.06.33 en, consider restricti...

PT-2023-19409 · Jensen Of Scandinavia · Jensen Of Scandinavia Eagle 1200Ac

Name of the Vulnerable Software and Affected Versions: Jensen of Scandinavia Eagle 1200AC version V15.03.06.33 en Description: A stack overflow issue was discovered via the ssid parameter at the "/goform/WifiBasicSet" API endpoint. This issue affects the Jensen of Scandinavia Eagle 1200AC device...

PT-2023-15687 · Sophos · Sophos Connect

Name of the Vulnerable Software and Affected Versions: Sophos Connect versions prior to 2.2.90 Description: A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives. Recommendations: For Sophos Connect versions prior to 2.2.90, update to version 2.2.90 or lat...

PT-2023-16286 · Google · Youtube Embedded 1.2 Sdk

Name of the Vulnerable Software and Affected Versions: YouTube Embedded 1.2 SDK Description: The YouTube Embedded 1.2 SDK has a potential vulnerability in its binding logic. After binding to a service within the YouTube Main App, a remote context is created with the flags Context.CONTEXT INCLUDE...

PT-2023-19411 · Jensen Of Scandinavia · Jensen Of Scandinavia Eagle 1200Ac

Name of the Vulnerable Software and Affected Versions: Jensen of Scandinavia Eagle 1200AC version V15.03.06.33 en Description: A stack overflow issue was discovered via the wrlEn 5g parameter at the "/goform/WifiBasicSet" API endpoint. Recommendations: For Jensen of Scandinavia Eagle 1200AC versi...

PT-2023-5290 · Intel · Intel Quartus Prime Pro Edition

Name of the Vulnerable Software and Affected Versions: Intel Quartus Prime Pro Edition for linux versions prior to 22.4 Description: The issue is related to the use of insufficiently random values in some Intel Agilex software, which is part of Intel Quartus Prime Pro Edition for linux. This may...

PT-2023-19426 · Jensen Of Scandinavia · Jensen Of Scandinavia Eagle 1200Ac

Name of the Vulnerable Software and Affected Versions: Jensen of Scandinavia Eagle 1200AC version 15.03.06.33 en Description: A stack overflow issue was discovered via the wepkey3 parameter at the "/goform/WifiBasicSet" API endpoint. Recommendations: For Jensen of Scandinavia Eagle 1200AC version...

PT-2023-20583 · Ibm · Ibm Http Server

Name of the Vulnerable Software and Affected Versions: IBM HTTP Server versions 8.5 Description: The issue allows a remote user to cause a denial of service using a specially crafted URL. Recommendations: For IBM HTTP Server version 8.5, consider restricting access to the server until a fix is...

PT-2023-16739 · Unknown · Microweber

Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.3.3 Description: The issue is related to Cross-site Scripting XSS - Stored, which allows attackers to inject malicious scripts into the website. A patch is available and is anticipated to be part of...

PT-2023-20058 · Unknown · Online Reviewer Management System

Name of the Vulnerable Software and Affected Versions: Online Reviewer Management System version 1.0 Description: An issue was discovered in the Online Reviewer Management System, where a SQL injection can directly issue instructions to the background database system via the "reviewer...

PT-2023-18865 · Unknown · Art Gallery Management System Project

Name of the Vulnerable Software and Affected Versions: Art Gallery Management System Project version 1.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the message parameter on the "enquiry page" A...

PT-2023-19727 · Unknown · Simple Customer Relationship Management System

Name of the Vulnerable Software and Affected Versions: Simple Customer Relationship Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the name parameter under the "Request a Quote" function. Recommendations: F...

PT-2023-21045 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns the /api/v4/users/me/teams API endpoint, where Mattermost fails to honor the ShowEmailAddress setting. This allows an attacker with team admin privileges to obtain the...