rack-cors gem for Ruby directory traversal vulnerability

rack-cors is Rack middleware for handling cross-domain resource sharing CORS. A directory traversal vulnerability in the rack-cors gem for Ruby prior to version 1.0.4, which stems from resource matching failing to ensure that pathnames are in a canonical format, can be exploited by an attacker to...

CVE-2019-18978

An issue was discovered in the rack-cors aka Rack CORS Middleware gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

Code Execution Vulnerability in ZhiCms V1.0.4

ZhiCms is an enterprise building system based on PHP and mysql technology. A code execution vulnerability exists in ZhiCms v1.0.4, which is due to the system failing to effectively filter input parameters. An attacker can exploit this vulnerability to write a Trojan horse and execute it to obtain...

ZhiCms V1.0.4 suffers from a command execution vulnerability

ZhiCms is an enterprise building system based on PHP and mysql technology. ZhiCms V1.0.4 suffers from a command execution vulnerability, which is due to the system failing to effectively filter input parameters. An attacker can exploit this vulnerability to write a Trojan horse and execute it to...

PT-2019-11791 · Jenkins · Jenkins Aqua Security Serverless Scanner Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Aqua Security Serverless Scanner Plugin versions 1.0.4 and earlier Description: The issue involves the transmission of configured passwords in plain text as part of job configuration forms, potentially leading to their exposure...

CVE-2017-18569

The my-wp-translate plugin before 1.0.4 for WordPress has CSRF...

CVE-2017-18568

The my-wp-translate plugin before 1.0.4 for WordPress has XSS...

GHSA-F7R3-P866-Q9QR ircdkit vulnerable to Denial of Service due to unhandled connection end event

Versions of ircdkit 1.0.3 and prior are vulnerable to a remote denial of service. Recommendation Upgrade to version 1.0.4...

ircdkit vulnerable to Denial of Service due to unhandled connection end event

Versions of ircdkit 1.0.3 and prior are vulnerable to a remote denial of service. Recommendation Upgrade to version 1.0.4...

GHSA-29GP-92WP-94Q8 react-dev-utils on Windows vulnerable to Remote Code Execution

react-dev-utils on Windows is vulnerable to remote code execution. Recommendation Update to one of the following versions, depending on the release line that you are using. - 1.0.4 - 2.0.2 - 3.1.2 - 4.2.2 - 5.0.2 - 6.0.0-next.a671462c...

CrashFix SQL Injection Vulnerability

CrashFix is a backend analysis tool for CrashRpt. The tool is mainly used to receive, store, organize and analyze error reports sent by CrashRpt. A SQL injection vulnerability exists in CrashFix version 1.0.4. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with...

CVE-2018-16474

A stored xss in tianma-static module versions =1.0.4 allows an attacker to execute arbitrary javascript...

Microsoft ASP.NET Core Security Feature Bypass Vulnerability (Jul 2018)

This host is missing an important security update according to Microsoft advisory CVE-2018-8171. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

CVE-2018-12984

Hycus CMS 1.0.4 allows Authentication Bypass via "'=' 'OR'" credentials...

Hycus CMS Authentication Bypass Vulnerability

Hycus CMS is a PHP and MySQL based, scalable, open source content management system CMS. An authentication bypass vulnerability exists in Hycus CMS version 1.0.4. The vulnerability can be exploited to bypass authentication with the help of "'=' 'OR'" credentials...

hycus CMS 1.0.4 - Authentication Bypass

Exploit Title: hycus Content Management System v1.0.4 Login Page Bypass Google Dork:N/A Date: 28.06.2018 Exploit Author: Berk Dusunur Vendor Homepage: http://www.hycus.com/ Software Link: http://demosite.center/hycus/ Version: 1.0.4 Tested on: Pardus / Debian Web Server CVE : N/A Proof Of Concept...

EyouCms V1.0.4 Arbitrary File Reading Vulnerability

Eyou Content Management System EyouCms is developed by php + mysql a set of open source cms dedicated to small and medium-sized enterprise website construction. EyouCms V1.0.4 exists arbitrary file reading vulnerability. An attacker can use this vulnerability to read any file in the system...

SQL Injection Vulnerability in SEMCMS PHP Multi-language Edition V1.0.4

SemCms is a set of open source foreign trade enterprise website management system, mainly used for foreign trade enterprises, compatible with IE, Firefox, google, 360 and other mainstream browsers. SEMCMS foreign trade website PHP multi-language version V1.0.4 SQL injection vulnerability ,...

PHP Scripts Mall Match Clone Script Cross-Site Scripting Vulnerability

PHP Scripts Mall Match Clone Script is a matrimonial dating software from PHP Scripts Mall India. The program features live chat, privacy protection and member registration. A cross-site scripting vulnerability exists in PHP Scripts Mall Match Clone Script version 1.0.4. A remote attacker can...

PT-2018-16163

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer gem versions prior to 1.0.4 Description The issue allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments, potentially leading to an XSS attack on target...