Taocms SQL注入漏洞

Taocms is a micro Cms Content Management System in China. A SQL injection vulnerability exists in Taocms version 3.0.2. The vulnerability stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to perform SQL injection via t...

CVE-2022-23880

An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file...

GHSA-R5HC-WM3G-HJW6 Server-Side Request Forgery (SSRF) in rudloff/alltube

Impact Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname. Patches 3.0.2 contains a fix for this vulnerability. The 1.x and 2.x releases are not maintained anymore. Part of the fix requires applyi...

CVE-2022-23316

An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt...

Arbitrary file deletion

An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt...

Taocms path traversal vulnerability

Taocms is a micro Cms content management system in China. taocms in v3.0.2 version there is an arbitrary file reading vulnerability, the vulnerability stems from the lack of filtering and restrictions on the software's path parameters, an attacker can use the vulnerability to read arbitrary files...

Taocms SQL注入漏洞

Taocms is a micro Cms Content Management System in China. Taocms in v3.0.2 version exists SQL injection vulnerability, the vulnerability stems from taocmsincludeModelArticle.php for SQL statements lack of effective filtering and escaping. An attacker can exploit this vulnerability to execute...

Taocms 路径遍历漏洞

Taocms is a micro Cms content management system in China. taocms in v3.0.2 version there is an arbitrary file reading vulnerability, the vulnerability stems from the lack of filtering and restrictions on the software's path parameters, an attacker can use the vulnerability to read arbitrary files...

Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. The fixed versions are 3.2.1 3.1.2 3.0.2 and 2.0.1.

...

CVE-2021-45015

taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72...

taocms 路径遍历漏洞

Taocms is a Chinese micro Cms Content Management System. A security vulnerability in taocms 3.0.2 allows attackers to arbitrarily delete files from line 60 to line 72 via taocmsincludeModelfile.php...

GHSA-QG54-694P-WGPP Regular expression denial of service vulnerability (ReDoS) in date

Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected. The fix limits the input length up to 128 bytes by default...

CVE-2021-34357

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 2021/08/25 and...

CVE-2021-34357

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 2021/08/25 and...

CVE-2021-34357

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 2021/08/25 and...

GHSA-Q897-9JXF-JG9R Security check skip in Apache Dubbo

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check when enabled and reaching a deserialization operation with native jav...

Sql injection

Pimcore Customer Data Framework version 3.0.0 and earlier suffers from a Boolean-based blind SQL injection issue in the $id parameter of the SegmentAssignmentController.php component of the application. This issue was fixed in version 3.0.2 of the product...

CVE-2021-37833

A reflected cross-site scripting XSS vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands...

DEBIAN-CVE-2021-37833

A reflected cross-site scripting XSS vulnerability exists in multiple pages in version 3.0.2 of the Hotel Druid application that allows for arbitrary execution of JavaScript commands...

DEBIAN-CVE-2021-37832

A SQL injection vulnerability exists in version 3.0.2 of Hotel Druid when SQLite is being used as the application database. A malicious attacker can issue SQL commands to the SQLite database through the vulnerable idappartamenti parameter...