CVE-2021-26837

CVE-2021-26837 HelpSystems / Fortra DeliverNow におけるSQLインジェクション DeliverNowのログ検索ページ（/LogGrid.aspx）のSearchTextboxパラメータは、パラメータ化もサーバーサイド検証も行われずにSQL Serverクエリに直接連結されます。また、アプリケーションは生成されたSQL Serverパーサーエラーをそのままユーザーに表示していたため、これが最初にこのバグが顕在化した経路となりました。...

CVE-2024-28100 Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw

eLabFTW is an open source electronic lab notebook for research labs. By uploading specially crafted files, a regular user can create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application. This can be triggered by the visitor viewing a li...

PT-2024-22265 · Elabftw · Elabftw

Name of the Vulnerable Software and Affected Versions: eLabFTW versions prior to 5.0.0 Description: The issue allows a regular user to create a circumstance where a visitor's browser runs arbitrary JavaScript code in the context of the eLabFTW application by uploading specially crafted files. Thi...

Issue while deploying Session Recording servers from within the Cloud

Error "The Current machine does not have sysadmin access" while deploying Session Recording servers from within the Cloud...

CVE-2022-2711 WP All Import < 3.6.9 - Admin+ Directory traversal via file upload

The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vect...

CVE-2019-11661: Undefined Security Weakness

Allow changes to some table by non-SysAdmin in Micro Focus Service Manager product versions 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, 9.41, 9.50, 9.51, 9.52, 9.60, 9.61, 9.62. This vulnerability could be exploited to allow unauthorized access and modification of data...