CVE-2024-36070: Exposure of Sensitive System Information to an Unauthorized Control Sphere

tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php. An update is also available for the 2022.11 series...

PT-2024-26880 · Tine · Tine

Name of the Vulnerable Software and Affected Versions: tine versions prior to 2023.11.8 Description: The issue allows anonymous remote attackers to obtain sensitive authentication information via setup.php because of getRegistryData in Setup/Frontend/Json.php, when an LDAP backend is used...

tine 安全漏洞

tine is a team collaboration software from tine, Inc. A security vulnerability exists in versions of tine prior to 2023.11.8, which stems from a vulnerability that allows remote attackers to obtain sensitive authentication information via setup.php...

CVE-2024-1921 osuuu LightPicture Setup.php unrestricted upload

A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the...

PT-2024-18423 · Unknown · Osuuu Lightpicture

Name of the Vulnerable Software and Affected Versions: osuuu LightPicture versions up to 1.2.2 Description: A critical issue was found in osuuu LightPicture, affecting an unknown function of the file /app/controller/Setup.php. This issue leads to unrestricted upload and can be exploited remotely...

CVE-2024-1921: Unrestricted Upload of File with Dangerous Type

A vulnerability, which was classified as critical, was found in osuuu LightPicture up to 1.2.2. Affected is an unknown function of the file /app/controller/Setup.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the...

VulnCheck KEV: CVE-2018-11686

The Publish Service in FlexPaper later renamed FlowPaper 2.3.6 allows remote code execution via setup.php and changeconfig.php...

CVE-2021-25857

An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the fonttype parameter to setup.php...

Code injection

An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the fonttype parameter to setup.php...

CVE-2021-25857: Undefined Security Weakness

An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the fonttype parameter to setup.php...

The vulnerability in the setup.php script of the software installer for managing medical organizations like OpenEMR allows a malicious individual to gain unauthorized access to protected information.

The vulnerability in the setup.php script of the software for managing medical organizations like OpenEMR relates to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Path traversal

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...

CVE-2023-22974

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...

CVE-2023-22974: Files or Directories Accessible to External Parties

A Path Traversal in setup.php in OpenEMR 7.0.0 allows remote unauthenticated users to read arbitrary files by controlling a connection to an attacker-controlled MySQL server...

SUSE CVE-2007-5386

Cross-site scripting XSS vulnerability in scripts/setup.php in phpMyAdmin 2.11.1, when accessed by a browser that does not URL-encode requests, allows remote attackers to inject arbitrary web script or HTML via the query string...

SUSE CVE-2022-23134

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend...

CVE-2022-23134

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend...

CVE-2022-23134

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend...

CVE-2022-23134: Improper Access Control

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend...

phpwcms code injection vulnerability

phpwcms is an open source Web content management system. It is fast, easy to install and runs on any standard web server platform that supports PHP/MySQL. phpwcms suffers from a code injection vulnerability that can be exploited by attackers via /phpwcms/setup/setup.php...