Path traversal

flarum is a forum software package for building communities. In versions prior to 1.7.0 an admin account which has already been compromised by an attacker may use a vulnerability in the LESS parser which can be exploited to read sensitive files on the server through the use of path traversal...

SUSE CVE-2008-3325

Cross-site request forgery CSRF vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page...

SUSE CVE-2014-1418

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the 1 Vary: Cookie or 2 Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers...

Wings 后置链接漏洞

Wings is the server control interface for Pterodactyl Panel. A backlink vulnerability exists in Wings v1.7.x prior to v1.7.4, and v1.11.x prior to v1.11.4, which stems from the ability to recursively delete files and directories on the host system, which could be exploited by an attacker to...

CVE-2022-46639

A vulnerability in the descargaetiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal...

PrestaShop 路径遍历漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution offers multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in Correos Prestashop version 1.7.x, which stems from the descargaetiqueta.php...

PT-2023-10228 · Overdrive Eletrônica · Course-Builder

Name of the Vulnerable Software and Affected Versions: Overdrive Eletrônica course-builder versions up to 1.7.x Description: A vulnerability was found in the course-builder, classified as problematic, affecting some unknown functionality of the file coursebuilder/modules/oeditor/oeditor.html. The...

CVE-2023-0254

The Simple Membership WP user Import plugin for WordPress is vulnerable to SQL Injection via the ‘orderby’ parameter in versions up to, and including, 1.7 due to insufficient escaping on the user supplied parameter. This makes it possible for authenticated attackers with administrative privileges...

PT-2023-16114 · WordPress · Simple Membership Wp User Import

Name of the Vulnerable Software and Affected Versions: Simple Membership WP user Import plugin for WordPress versions up to, and including, 1.7 Description: The issue allows for SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter. This enables...

PT-2023-18518 · Tokio · Tokio

Name of the Vulnerable Software and Affected Versions: Tokio versions 1.7.0 through 1.18.3 Tokio versions 1.18.4 through 1.20.2 Tokio versions 1.20.3 through 1.23.0 Description: When configuring a Windows named pipe server, setting pipe mode will reset reject remote clients to false. If the...

CVE-2022-4637 ep3-bs cross site scripting

A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is...

CVE-2022-4637 ep3-bs cross site scripting

A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.8.0 is able to address this issue. The name of the patch is...

GHSA-R48C-4VFJ-H426 collective.dms.basecontent Cross-site Scripting vulnerability

A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated remotely...

PYSEC-2022-42989

A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the file src/collective/dms/basecontent/browser/column.py. The manipulation leads to cross site scripting. The attack may be initiated...

collective.dms.basecontent 跨站脚本漏洞

collective.dms.basecontent is Collective open source a document management system for the basic content class . collective.dms.basecontent version 1.7 suffers from a cross-site scripting vulnerability. Attackers use this vulnerability to execute cross-site scripting attacks...

Jenkins Plugin JAPEX 代码问题漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A code issue vulnerabilit...

Hiby Music Hiby R3 PRO firmware 代码问题漏洞

Hiby Music Hiby R3 PRO firmware is the firmware for a portable music player from the Chinese company Hiby Music Hiby Music. A code issue vulnerability exists in Hiby R3 PRO firmware versions v1.5 through v1.7, which stems from a file upload vulnerability...

PT-2022-22432 · Md2Roff · Md2Roff

Name of the Vulnerable Software and Affected Versions: md2roff version 1.7 Description: The issue is a stack-based buffer overflow that occurs when processing a Markdown file containing a large number of consecutive characters. It's noted that the vendor's position is that the product is not...

md2roff 缓冲区错误漏洞

md2roff is a personal developer by Nicholas Christopoulos that converts markdown to groff / troff man, mdoc, mm, mom documents. A buffer error vulnerability exists in md2roff version 1.7, which is caused by a stack-based buffer overflow in Markdown files containing a large number of consecutive...