CVE-2020-9270

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...

CVE-2020-9270

CVE-2020-9270 affects Ice Hrm 26.2.0, where a Cross-Site Request Forgery (CSRF) vulnerability enables a password reset via the service.php endpoint. The available connected records confirm IceHrm 26.2.0 is the affected version and describe the flaw as CSRF leading to unintended password resets; n...

CVE-2020-9271

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...

CVE-2020-9271

Ice Hrm 26.2.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability that can lead to user creation via service.php. The issue is documented across multiple sources (NVD, Red Hat, CNVD, OSV, etc.) with consistent description: unauthenticated CSRF could cause a legitimate user action to...

CVE-2020-9270: Cross-Site Request Forgery (CSRF)

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via service.php...

CVE-2020-9271: Cross-Site Request Forgery (CSRF)

ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via service.php...

PT-2020-20564

Name of the Vulnerable Software and Affected Versions ICE Hrm version 26.2.0 Description The issue allows for CSRF, leading to unauthorized password reset through the "service.php" endpoint. Recommendations For ICE Hrm version 26.2.0, update to a version that includes a fix for this issue, as no...

PT-2020-20565

Name of the Vulnerable Software and Affected Versions ICE Hrm version 26.2.0 Description The issue allows for CSRF, leading to unauthorized user creation. This occurs via the "service.php" endpoint. Recommendations For ICE Hrm version 26.2.0, update to a newer version that contains a fix for this...

CVE-2014-3542

mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE...

CVE-2014-3542

Moodle’s mod/lti/service.php in versions up to 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 is affected by an XML External Entity (XXE) issue. The vulnerability allows remote attackers to read arbitrary files via an XML entity declaration combined wi...

CVE-2014-3542: Exposure of Sensitive Information to an Unauthorized Actor

mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE...

PT-2014-5380

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, 2.7.x before 2.7.1 Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction wit...

PT-2014-4286

Name of the Vulnerable Software and Affected Versions Dell KACE K1000 version 5.4.76847 and possibly earlier Description The issue allows remote attackers or remote authenticated users to execute arbitrary SQL commands. This can be achieved via several means, including the macAddress element in a...

CVE-2012-2361: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/webservice/forms.php in the web services implementation in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the name field aka the service name to...

PT-2012-3982

Name of the Vulnerable Software and Affected Versions Moodle versions 2.0.x through 2.0.8 Moodle versions 2.1.x through 2.1.5 Moodle versions 2.2.x through 2.2.2 Description A cross-site scripting XSS issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the...

PT-2012-5124

Name of the Vulnerable Software and Affected Versions TikiWiki CMS/Groupware versions 8.3 and earlier Description The issue allows remote attackers to obtain the installation path via a direct request to API endpoints such as "admin/include calendar.php", "tiki-rss error.php", or "tiki-watershed...

PT-2012-2050

Name of the Vulnerable Software and Affected Versions Support Incident Tracker aka SiT! versions prior to 3.65 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via various parameters in different PHP files, including the start parameter to...

PT-2011-4611

Name of the Vulnerable Software and Affected Versions concrete5 versions 5.4.0.5 through 5.4.1.1 Description The issue allows remote attackers to obtain sensitive information via a direct request to a .php file. This is achieved by revealing the installation path in an error message. For example,...

Unfixed XSS vulnerability at www.totalwellbeing.ie

Security researcher BackDoor, has submitted on 30/05/2008 a cross-site-scripting XSS vulnerability affecting www.totalwellbeing.ie, which at the time of submission ranked 3775740 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/06/2008. It is...