7050 matches found
elitecms SQL注入漏洞
Elitecms is a web content management from elitecms India. elitecms version 1.01 has a SQL injection vulnerability, which originates from /admin/editpage.php?page= page lack of validation of external input SQL statements, an attacker can use the vulnerability to execute illegal SQL commands to ste...
Wedding Management System SQL注入漏洞
Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to SQL injection, which originates from the lack of validation of external The vulnerability is caused by a lack of validation of extern...
GitLab Enterprise Edition和GitLab Community Edition 跨站脚本漏洞
GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD continuous integration and continuous delivery, and other features. A cross-site scripting vulnerability exists in GitLab Community Edition and...
elitecms SQL注入漏洞
Elitecms is a Web content management from elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the lack of validation of external input SQL statements on the /admin/addpost.php page, which can be exploited by attackers to execute illegal SQL commands to ste...
CVE-2022-26977
The Barco Control Room Management Suite web application (TransForm N before 3.14) exposes a license file upload mechanism with insufficient input sanitization, resulting in stored XSS. Affected component is the upload handling; impact is client-side script execution. No exploitation details are p...
CVE-2022-27782
libcurl would reuse a previously created connection even when a TLS or SSHrelated option had been changed that should have prohibited reuse.libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse if one of them matches the setup. However, several TLS andSSH...
GitLab: Bypass for Domain-level redirects (Unvalidated Redirects and Forwar)
Summary F1745460 While testing for the ability to define custom redirects in Gitlab Pages, I discovered I was able to define Domain-level redirects which are explicitly disabled in the documentation. At a first glance, the validation step seems to disable any link not starting with /, It has...
Mini-XML 安全漏洞
Mini-XML is a small XML parser developed in C. A denial of service vulnerability exists in Mini-XML v3.2, which stems from the failure to validate input strings in mxmlLoadString and can be exploited by attackers to cause a denial of service...
CSCMS Music Portal System SQL注入漏洞
CSCMS Music Portal System is a diversified content management system from China Sunshine Network Technology CSCMS, Inc. A SQL injection vulnerability exists in CSCMS Music Portal System, which originates from the missing validation of the id parameter in /admin.php/Label/jsdel for external input...
PT-2022-23725 · Ivanti · Ivanti Avalanche
Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche version 6.3.3.101 Description: This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing authentication mechanism can be...
CSCMS Music Portal System SQL注入漏洞
CSCMS Music Portal System is a diversified content management system of China Chong Sheng Network Technology CSCMS Company. CSCMS Music Portal System suffers from a SQL injection vulnerability that originates from the lack of validation of the id parameter in /admin.php/vod/admin/topic/del for...
Unvalidated Follow redirects
Description There is some kind of vulnerability class in the following redirect feature, And Guzzle is also affected by this kind of vulnerability. If the developer wants to get a URL from a third-party host and the third-party URL is also redirected to another URL, then the first crafted cookies...
Creativeitem Academy-LMS 跨站脚本漏洞
Creativeitem Academy-LMS, an online learning platform from Creativeitem, Inc. A cross-site scripting vulnerability exists in Creativeitem Academy-LMS v4.3, which stems from a lack of data validation filtering of user-supplied data and output in the SEO panel. An attacker could exploit this...
GHSA-C7RM-W2HJ-X8G3 Guard bypass in Eloquent models affecting Laravel illuminate database component
An issue was discovered in Laravel before 6.18.34 and 7.x before 7.23.2. Unvalidated values are saved to the database component in some situations in which table names are stripped during a mass assignment...
IBM i SQL注入漏洞
IBM i is a set of operating systems from IBM running in IBM Power Systems and IBM PureSystems. IBM i versions 7.3, 7.4 and 7.5 have a SQL injection vulnerability, which stems from the application's lack of validation of external input SQL statements and can be used by attackers to execute illegal...
CVE-2021-41714
In Tipask 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage...
CVE-2022-0346
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allowurlinclude is turned on...
Tipask 安全漏洞
Tipask is an open-source PHP question and answer system by the individual developer Song Dengfeng sdfsky in China. A security vulnerability exists in Tipask versions prior to 3.5.9, which is caused by a user inputting a path parameter that is not validated when downloading attachments. An attacke...
IBM Sterling B2B Integrator 代码问题漏洞
IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with different partner communities.A denial of service vulnerability exists in IBM Sterling B2B...