Design/Logic Flaw

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5...

Logic Flaw Vulnerability in Tanto CMS V1.2

Skyway CMS is a simple website management system. A logic flaw exists in Tanto CMS V1.2, which can be exploited by an attacker to log in to the back-end of a website without an account password...

CloudBees Jenkins chosen-views-tabbar Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

New Raccoon Attack Could Let Attackers Break SSL/TLS Encryption

A group of researchers has detailed a new timing vulnerability in Transport Layer Security TLS protocol that could potentially allow an attacker to break the encryption and read sensitive communication under specific conditions. Dubbed "Raccoon Attack," the server-side attack exploits a...

PT-2020-15443 · Jenkins · Jenkins Deployer Framework Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Deployer Framework Plugin versions 1.2 and earlier Description: The issue is related to a stored cross-site scripting vulnerability. It occurs because the URL displayed in the build home page is not properly escaped. This vulnerabilit...

PT-2021-10979 · Speex +1 · Speex +1

Name of the Vulnerable Software and Affected Versions: Speex version 1.2 Description: A stack buffer overflow in speexenc.c allows attackers to cause a denial of service DoS via a crafted WAV file. The vendor states that the issue cannot be reproduced and that it is a demo program. Recommendation...

CVE-2020-14054

SOKKIA GNR5 Vanguard WEB version 1.2 build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3 and hardware version 212 allows remote attackers to bypass admin authentication via a SQL injection attack that uses the User Name or Password field on the login page...

Heybbs 1.2 re***.php file has SQL injection vulnerability (CNVD-2020-31449)

HEYBBS micro-community is a front-end based on bootstrap+jq+css, back-end php+mysql development of micro-community program. A SQL injection vulnerability exists in the Heybbs 1.2 re.php file, which can be exploited by attackers to obtain database information...

Improper access control

X.509 certificates generated by the MongoDB Enterprise Kubernetes Operator may allow an attacker with access to the Kubernetes cluster improper access to MongoDB instances. Customers who do not use X.509 authentication, and those who do not use the Operator to generate their X.509 certificates ar...

CVE-2020-11000

GreenBrowser before version 1.2 has a vulnerability where apps that rely on URL Parsing to verify that a given URL is pointing to a trust server may be susceptible to many different ways to get URL parsing and verification wrong, which allows an attacker to circumvent the access control. This...

CVE-2020-11000

GreenBrowser before version 1.2 has a vulnerability where apps that rely on URL Parsing to verify that a given URL is pointing to a trust server may be susceptible to many different ways to get URL parsing and verification wrong, which allows an attacker to circumvent the access control. This...

Design/Logic Flaw

GreenBrowser before version 1.2 has a vulnerability where apps that rely on URL Parsing to verify that a given URL is pointing to a trust server may be susceptible to many different ways to get URL parsing and verification wrong, which allows an attacker to circumvent the access control. This...

CloudBees Jenkins Subversion Release Manager Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . Subversion Release Manager Plugin is used ...

SQL Injection Vulnerability in Heybbs Micro Community v1.2

HEYBBS micro-community is a front-end based on bootstrap+jq+css, back-end php+mysql development of micro-community program. Heybbs micro-community v1.2 SQL injection vulnerability, attackers can use the vulnerability to obtain the database sensitive information leakage...

Design/Logic Flaw

Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 82002228K 08/09/2018, bios Version 1.2. Successful exploitation of this vulnerability could allow an attacker to upload a malicious file to the application...

Apache Log4j Untrusted Data Deserialization Vulnerability

Apache Log4j is the United States Apache Apache Software Foundation of a Java-based open source logging tools. A security vulnerability exists in Apache Log4j version 1.2. Attackers can exploit the vulnerability to execute code...

Cross site scripting

MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks...

WordPress accurate-form-data-real-time-form-validation plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. accurate-form-data-real-time-form-validation is used in which a form data real-time validation plugin. A cross-site request...

SyGuestBook A5 Cross-Site Scripting Vulnerability

SyGuestBook A5 is a PHP-based open source message board system . A cross-site scripting vulnerability exists in SyGuestBook A5 version 1.2 in index.php?c=admin&a=index. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit...

CVE-2019-13948

SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element...