NextCellent Gallery <= 1.9.35 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC Create/edit a gallery with at least one image...

Schneider Electric PowerLogic ION Setup security vulnerabilities

Schneider Electric PowerLogic ION Setup is a free, user-friendly configuration tool from Schneider Electric France. It provides an intuitive environment for setting up and verifying the settings of PowerLogic meters and other devices. A security vulnerability exists in Schneider Electric that ste...

Schneider Electric PowerLogic ION Setup Trust Management Vulnerability

Schneider Electric PowerLogic ION Setup is a free, user-friendly configuration tool from Schneider Electric France. It provides an intuitive environment for setting up and verifying the settings of PowerLogic meters and other devices. Schneider Electric is vulnerable to a trust management issue...

Schneider Electric PowerLogic ION Setup: Input validation error vulnerability

Schneider Electric PowerLogic ION Setup is a free, user-friendly configuration tool from Schneider Electric France. It provides an intuitive environment for setting up and verifying the settings of PowerLogic meters and other devices. An input validation error vulnerability exists in Schneider...

Schneider Electric PowerLogic ION Setup: Input validation error vulnerability

Schneider Electric PowerLogic ION Setup is a free, user-friendly configuration tool from Schneider Electric France. It provides an intuitive environment for setting up and verifying the settings of PowerLogic meters and other devices. An input validation error vulnerability exists in Schneider...

postgresql:10 security update

10.21-2 - Resolves: CVE-2022-1552 - Release bump due to wrongly reported CVE of libpq Build after reverted changes in libpq package 10.21-1 - Resolves: CVE-2022-1552 - Update to 10.21 - Release notes: https://www.postgresql.org/docs/release/10.21/ 10.19-2 - Add missing files into file section of...

Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape a settings before outputting it in the Debug page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in the "Try ...

eu.lundegaard.liferay:liferay-db-setup-core (3.0.0) potentially affected by CVE-2021-33322 via com.liferay.portal:com.liferay.portal.impl (4.2.5)

com.liferay.portal:com.liferay.portal.impl MAVEN version 4.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core 3.0.0 Source cves: CVE-2021-333...

phpMyAdmin Cross-Site Request Forgery (CSRF)

A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page...

GHSA-4C9Q-64GQ-XHX4 phpMyAdmin Cross-Site Request Forgery (CSRF)

A CSRF issue in phpMyAdmin 4.9.0.1 allows deletion of any server in the Setup page...

de.eonas.portal:opencmsinstaller (9.0.0.1), org.opencms:opencms-setup (9.0.0) +17 more potentially affected by CVE-2019-11818 via org.opencms:opencms-core (9.0.0)

org.opencms:opencms-core MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.opencms:opencms-core and may be impacted: - de.eonas.portal:opencmsinstaller 9.0.0.1 - org.opencms:opencms-setup 9.0.0 -...

eu.lundegaard.liferay:liferay-db-setup-core (3.0.0) potentially affected by CVE-2021-33321 via com.liferay.portal:com.liferay.portal.impl (4.2.5)

com.liferay.portal:com.liferay.portal.impl MAVEN version 4.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core 3.0.0 Source cves: CVE-2021-333...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the MFAUserAccountSetupMVCActionCommand class that allows an authenticated used to deny service to another user by enabling the Time-based One-time password TOTP feature for their account, or by modifying the...

eu.lundegaard.liferay:liferay-db-setup-core (3.0.0) potentially affected by CVE-2020-15840 via com.liferay.portal:com.liferay.portal.impl (4.2.5)

com.liferay.portal:com.liferay.portal.impl MAVEN version 4.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core 3.0.0 Source cves: CVE-2020-158...

eu.lundegaard.liferay:liferay-db-setup-core (>=3.1.0, <=3.2.0) potentially affected by CVE-2020-15840 via com.liferay.portal:com.liferay.portal.impl (5.13.3)

com.liferay.portal:com.liferay.portal.impl MAVEN version 5.13.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.liferay.portal:com.liferay.portal.impl and may be impacted: - eu.lundegaard.liferay:liferay-db-setup-core =3.1.0, =3.2.0 Source cves:...

Ignite Realtime Openfire allows Cross-site Scripting

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. This issue was fixed in version 4.4.2...

GHSA-22C6-3H88-26M3 Ignite Realtime Openfire allows Cross-site Scripting

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. This issue was fixed in version 4.4.2...

Ignite Realtime Openfire allows Cross-site Scripting

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. This issue was fixed in version 4.4.2...

keycloak vulnerable to unauthorized login via mail server setup

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'...

GHSA-RR5G-RC28-WXWJ Dolibarr Cross-site Scripting via outgoing email setup feature

An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via the "Send all emails to instead of real recipients, for test purposes" field...