CVE-2017-18356

In the Automattic WooCommerce plugin before 3.2.4 for WordPress, an attack is possible after gaining access to the target site with a user account that has at least Shop manager privileges. The attacker then constructs a specifically crafted string that will turn into a PHP object injection...

GROWI vulnerable to cross-site scripting

Overview GROWI provided by WESEEK, Inc. contains a cross-site scripting vulnerability CWE-79. The settings option for enabling and disabling the measures against cross-site scripting "Enable XSS prevention" option was introduced in v3.1.12. However, there was an issue with the implementation wher...

CVE-2018-19596

Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506...

phpBB < 3.2.4 RCE Vulnerability

phpBB is prone to a remote code execution RCE vulnerability through object injection. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

ThinkPHP SQL Injection Vulnerability (CNVD-2018-21504)

ThinkPHP is an open source, lightweight PHP-based web application development framework. ThinkPHP 3.2.4 version of the Library/Think/Db/Driver.class.php file 'parseOrder' function SQL injection vulnerability, the vulnerability stems from the program incorrectly handles the variable key. remote...

ThinkPHP SQL Injection Vulnerability (CNVD-2018-21507)

ThinkPHP is an open source, lightweight PHP-based web application development framework. A SQL injection vulnerability exists in ThinkPHP version 3.2.4, which stems from the failure of the 'parseKey' function to properly handle the variable key.A remote attacker can exploit this vulnerability to...

HPE Device Entitlement Gateway SQL Injection Vulnerability

HPE Device Entitlement Gateway DEG is a set of device entitlement management solutions from Hewlett Packard Enterprise HPE. A SQL injection vulnerability exists in HPE DEG versions 3.2.4, 3.3, and 3.3.1, which can be exploited by remote attackers to inject SQL commands and elevate privileges...

Zurmo cross-site scripting vulnerability (CNVD-2019-07202)

Zurmo is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. A cross-site scripting vulnerability exists in Zurmo version 3.2.4 Stable. A remote attacker can exploit this vulnerability to execute injected malicious script with the help of th...

Moodle 3.x Multiple Vulnerabilities (Sep 2017) - Windows

Moodle CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

Bitpie application for Android and iOS information disclosure vulnerability

Bitpie application for Android is an Android-based application for managing and trading multiple blockchain assets.Bitpie application for iOS is its iOS-based version. A security vulnerability exists in versions 3.2.4 and earlier of the Bitpie application for Android and iOS based platforms, whic...

CVE-2018-1101

Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrato...

CVE-2017-2550

Vulnerability in Easy Joomla Backup v3.2.4. The software creates a copy of the backup in the web root with an easily guessable filename...

Easy Joomla Backup Information Disclosure Vulnerability

Easy Joomla Backup is a plugin with backup functionality for use in Joomla. A security vulnerability exists in Easy Joomla Backup version 3.2.4, which originates when the program creates a copy of a backup file in the web root directory and uses a poorly secured filename. An attacker can exploit...

DEBIAN-CVE-2016-4793

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...

UBUNTU-CVE-2016-4793

The clientIp function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the CLIENT-IP HTTP header...

Redis remote code execution vulnerability(CVE-2 0 1 6-8 3 3 9)-vulnerability warning-the black bar safety net

Affected system: Redis Redis 3.2. x 3.2.4 Description: BUGTRAQ ID: 9 3 2 8 3 CVECAN ID: CVE-2 0 1 6-8 3 3 9 Redis is an open source, support network, based on memory, key-value pairs stored in the database, use ANSI C to write. Redis 3.2. x 3.2.4 version there is a buffer overflow vulnerability...

dotCMS 3.2.4 - 多个 漏洞

No description provided by source...

DEBIAN-CVE-2014-9462

The validaterepo function in sshpeer in Mercurial before 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command...

Fork CMS 3.2.4 - Multiple Vulnerabilities (LFI - XSS)

No description provided by source...

rubygem-activerecord: SQL injection when processing nested query paramaters

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query...