PT-2022-17762 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: EyouCMS version 1.5.5 Description: The issue is related to a lack of access control in the component /data/sqldata. Recommendations: For EyouCMS version 1.5.5, consider restricting access to the /data/sqldata component until a patch is...

EyouCms 安全漏洞

Zanzan Network Technology EyouCms Eyou CMS is an open source content management system CMS based on ThinkPHP by China Zanzan Network Technology. A security vulnerability exists in the /data/sqldata component of EyouCms v1.5.5, which stems from the lack of access control in the component...

UBUNTU-CVE-2022-24713

regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those tunable mitigations already provide sane defaults to preven...

RUSTSEC-2022-0013 Regexes with large repetitions on empty sub-expressions take a very long time to parse

The Rust Security Response WG was notified that the regex crate did not properly limit the complexity of the regular expressions regex it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes...

WordPress Music Player for Elementor – Audio Player & Podcast Player plugin < 1.5.5 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Music Player for Elementor – Audio Player & Podcast Player plugin versions 1.5.5. Solution Update the WordPress Music Player for Elementor – Audio Player & Podcast Player plugin to the latest available version at least 1.5.5...

CVE-2021-46255

eyouCMS V1.5.5-UTF8-SP31 suffers from Arbitrary file deletion due to insufficient filtering of the parameter filename...

CVE-2021-29060

A Regular Expression Denial of Service ReDOS vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string...

CVE-2021-29060

A Regular Expression Denial of Service ReDOS vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string...

Design/Logic Flaw

A Regular Expression Denial of Service ReDOS vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string...

CVE-2021-29060

A Regular Expression Denial of Service ReDOS vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string...

Color-String 安全漏洞

Color-String is an open source library for parsing and generating CSS color strings. A security vulnerability exists in Color-String 1.5.5 and earlier versions that stems from a Regular Expression Denial of Service ReDOS that occurs when an application examines a carefully crafted piece of data...

GHSA-RM7F-MPCJ-W4F6 Command injection in Apache Unomi

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements...

Spark Information Disclosure Vulnerability (CNVD-2021-37593)

Spark is a public domain FHIR server developed using C. A security vulnerability exists in versions prior to Firely/Incendi Spark 1.5.5-r4, which stems from the lack of a Content-Disposition header in some cases, which could result in carefully crafted files being delivered to the client to be...

CVE-2021-32054

Firely/Incendi Spark before 1.5.5-r4 lacks Content-Disposition headers in certain situations, which may cause crafted files to be delivered to clients such that they are rendered directly in a victim's web browser...

Firely/Incendi Spark 安全漏洞

Spark is a public domain FHIR server developed using C. A security vulnerability exists in versions prior to Firely/Incendi Spark 1.5.5-r4, which stems from the lack of a Content-Disposition header in some cases, which could result in carefully crafted files being delivered to the client to be...

CVE-2021-31164

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements...

rack-protection: Timing attack in authenticity_token.rb

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to hav...

flatCore CMS 1.5.5 Cross Site Scripting / Arbitrary File Upload Vulnerabilities

Exploit for php platform in category web applications title: Multiple Vulnerabilities product: flatCore CMS vulnerable version: =1.5.5 fixed version: 1.5.7 CVE number: - impact: High homepage: https://flatcore.org/ found: 2020-03-28 by: Farhan Rahman Office Malaysia Azrul Ikhwan Zulkifli Office...

VulnCheck KEV: CVE-2020-36728

The Adning Advertising plugin for WordPress is vulnerable to file deletion via path traversal in versions up to, and including, 1.5.5. This allows unauthenticated attackers to delete arbitrary files which can be used to reset and gain full control of a site...

Serendipity Package Cross-Site Scripting Vulnerability

Serendipity is a PHP-based blogging system from the Serendipity team. The system supports the creation of online journals, blogs, web pages and more. A cross-site scripting vulnerability exists in Xinha in Serendipity packages prior to version 1.5.5. The vulnerability stems from a lack of proper...