CVE-2021-28680

The devisemasquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise without this extension is used. If the...

CVE-2021-36328

Dell EMC Streaming Data Platform versions before 1.3 contain a SQL Injection Vulnerability. A remote malicious user may potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions and retrieve sensitive information from the database...

CVE-2021-33091

Insecure inherited permissions in the installer for the IntelR NUC M15 Laptop Kit audio driver pack before version 1.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

EC Cloud E-Commerce System 跨站请求伪造漏洞

Amazon Web Services Ec Cloud E-Commerce System is a cloud-based e-commerce system from Amazon Web Services, Inc. A security vulnerability exists in EC Cloud E-Commerce System version 1.3, which allows an attacker to arbitrarily add an administrator account via "/admin.html?do=user&act=add"...

CVE-2021-24396

A pageid GET parameter of the GSEOR – WordPress SEO Plugin WordPress plugin through 1.3 is not sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress plugin SEO, which stems from the pageid GET...

Skycaiji 路径遍历漏洞

Skycaiji Blue Sky Collector is a free data collection and publishing crawler software in China, developed with php+mysql and can be deployed on cloud servers. A path traversal vulnerability exists in Skycaiji version 1.3, which stems from. The vulnerability stems from a failure of a network syste...

CVE-2020-18454

Cross Site Request Forgery CSRF vulnerability in bycms v1.3 via admin.php/systems/index/moduleid/70/groupid/1.html...

NoneCMS Information Disclosure Vulnerability

NoneCMS is a content management system CMS based on Thinkphp. An information disclosure vulnerability exists in NoneCMS version 1.3. A remote attacker can exploit this vulnerability to obtain sensitive information via /nonecms/vendor...

NoneCMS 信息泄露漏洞

NoneCMS is a content management system CMS based on Thinkphp. An information disclosure vulnerability exists in NoneCMS version 1.3. A remote attacker can exploit this vulnerability to obtain sensitive information via /nonecms/vendor...

WordPress plugin 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . 404 SEO Redirection Cross-site request forgery...

NoneCMS 跨站请求伪造漏洞

NoneCMS is a simple and compact open-source content management system that can be used to quickly build corporate sites, personal blogs, and support mobile. A cross-site request forgery vulnerability exists in public/index.php/admin/nav/add.html in NoneCMS version 1.3. An attacker can use this...

Error Accessing Citrix Environment Using StoreFront 2.x and HTML5 Receiver 1.3 on Chrome v40 and Later

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company’s Help Desk/IT support team and can refer to CTX297149 for more information. Users get error when accessing Citrix environment using StoreFront 2.x and HTML5 Receiver 1.3 on...

sheila1227 gridx 安全漏洞

sheila1227 gridx is sheila1227 an open source application . For fast rendering , good modular and plug-in based architecture of the Grid. oria gridx 1.3 security vulnerability , a remote attacker can be exploited to execute arbitrary code through the $query parameter carefully set the value...

CVE-2021-3258

Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...

Cross site scripting

Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...

CVE-2021-3258

Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting XSS, which may lead to arbitrary remote code execution...

Question2Answer Q2A Ultimate SEO Cross-Site Scripting Vulnerability

Q2A Ultimate SEO is a component from the Q2A Projects team that provides search engine optimization functionality for Question2Answer. Question2Answer Q2A Ultimate SEO Version 1.3 suffers from a cross-site scripting vulnerability that leads to arbitrary remote code execution...

WordPress Process Steps Template Designer plugin <= 1.2.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress Process Steps Template Designer plugin versions = 1.2.1. Solution Update the WordPress Process Steps Template Designer plugin to the latest available version at least 1.3...

Design/Logic Flaw

In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. Eventually, the default token is allowed to access APISIX management data. This affects versions 1.2, 1.3, 1.4, 1.5...