EUVD-2022-35228

Malicious code in bioql PyPI...

CVE-2022-30013

A stored cross-site scripting XSS vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file...

CVE-2022-30013

A stored cross-site scripting XSS vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file...

CVE-2022-30013

A stored cross-site scripting XSS vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file...

CVE-2022-30013

A stored cross-site scripting XSS vulnerability in the upload function of totaljs CMS 3.4.5 allows attackers to execute arbitrary web scripts via a JavaScript embedded PDF file...

Totaljs CMS 12.0 Widget Creation Code Injection

Author/Discoverer: Riccardo Krauter @CertimeterGroup + Title: Totaljs CMS Authenticated Code injection on widget creation. + Affected software: Totaljs CMS 12.0 + Description: An authenticated user with “widgets” privilege can gain RCE on the remote server by creating a malicious widget with a...

Totaljs CMS 12.0 Path Traversal

Totaljs CMS authenticated path traversal could lead to RCE + Author/Discoverer: Riccardo Krauter @CertimeterGroup + Title: Totaljs CMS authenticated path traversal could lead to RCE + Affected software: Totaljs CMS 12.0 + Description: An authenticated user with “Pages” privilege can include via...

Totaljs CMS 12.0 Improper Access Control

Author/Discoverer: Riccardo Krauter @CertimeterGroup + Title: Totaljs CMS Broken Access Control on the API call + Affected software: Totaljs CMS 12.0 + Description: An authenticated user with limited privileges can get access to resource that did not own by calling the associated API. The CMS...

Totaljs CMS 12.0 Insecure Admin Session Cookie

Author/Discoverer: Riccardo Krauter @CertimeterGroup + Title: Totaljs CMS Insecure Admin Session cookie + Affected software: Totaljs CMS 12.0 + Description: A low privilege user can easily crack the owned cookie to obtain the “random” values inside it. If this user can leak a session cookie owned...