CVE-2019-15954

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...

CVE-2019-15954

Total.js CMS 12.0.0 is affected by an authenticated-user widget privilege vulnerability that enables Remote Command Execution (RCE) when a malicious widget uses a crafted tag containing JavaScript evaluated server-side. The back-end tag evaluation can be forced to escape the sandbox via payload l...

CVE-2019-15955

The CVE-2019-15955 entry describes a vulnerability in Total.js CMS 12.0.0 where a low-privilege user can transform an admin session cookie to reveal random values inside it, enabling brute‑forcing to steal the admin password. Sources across NVD/Red Hat/CVE listings confirm the affected product/ve...

CVE-2019-15955

An issue was discovered in Total.js CMS 12.0.0. A low privilege user can perform a simple transformation of a cookie to obtain the random values inside it. If an attacker can discover a session cookie owned by an admin, then it is possible to brute force it with On=2n instead of On=n^x complexity...

CVE-2019-15954: Total.js CMS 12 Widget Remote Code Execution

Total.js is a Node.js Framework for building e-commerce applications, REST services, real-time apps, or apps for Internet of Things IoT, etc. Total.js CMS is a Content Management System application that is part of the Total.js framework. A commercial version is also available, and can be seen use...

Path Traversal

Overview Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths. The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css,...

GHSA-72P5-2R6G-FM6V Moderate severity vulnerability that affects total.js

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...

Moderate severity vulnerability that affects total.js

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...

Total.js CMS Cross-Site Scripting Vulnerability

Total.js CMS is a content management system CMS based on a NoSQL database. A cross-site scripting vulnerability exists in Total.js CMS version 12.0.0. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

CVE-2019-10260

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...

CVE-2019-10260

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...

Design/Logic Flaw

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...

CVE-2019-10260

Total.js CMS 12.0.0 is affected by a Cross-Site Scripting (XSS) vulnerability in the admin UI: item.message handling in themes/admin/views/index.html and column.format handling in themes/admin/public/ui.js. The connected sources consistently identify the vulnerable components but do not provide a...

CVE-2019-10260

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html item.message and themes/admin/public/ui.js column.format...

Total.js Detection

Detection of Total.js. The script sends a connection request to the server and attempts to detect Total.js and to extract its version. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

Total.js Directory Traversal Vulnerability

Total.js is prone to a directory traversal vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:totaljs:total.js"; if...

Total.js prior to 3.2.4 Directory Traversal

This module check and exploits a directory traversal vulnerability in Total.js prior to 3.2.4. Here is a list of accepted extensions: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml, woff, woff2, otf, ttf, eot, svg, zip, rar, pdf, docx, xlsx, doc, xls, html, htm, appcache, manifest, map, ogv,...

autoremoteserver (>=0.1.5 <=0.2.3), bloater-renewed (=1.0.0) +3 more potentially affected by CVE-2019-8903 via total.js (>=1.2.3 <=2.9.30)

total.js NPM version =1.2.3, =0.1.5, =0.1.0, =0.0.1, =0.0.2 - vuejs-totaljs-project =1.0.0 Source cves: CVE-2019-8903 Source advisory: OSV:GHSA-3Q32-J57W-Q4W7...

GHSA-3Q32-J57W-Q4W7 Path Traversal in total.js

Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths. The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml...

Path Traversal in total.js

Affected versions of total.js are vulnerable to Path Traversal. Due to insufficient input sanitization in URLs, attackers can access server files outside the /public folder by using relative paths. The files served are limited to these file types: flac, jpg, jpeg, png, gif, ico, js, css, txt, xml...