Design/Logic Flaw

DISPUTED PEGA Platform 8.3.0 is vulnerable to a direct prweb/sso/randomtoken/!STANDARD?pyActivity=Data-Admin-DB-Name.DBSchemaListDatabases request while using a low-privilege account. This can perform actions and retrieve data that only an administrator should have access to. NOTE: The vendor...

PT-2019-14653 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: PEGA Platform version 8.3.0 Description: The issue allows information disclosure via a direct request to "prweb/sso/random token/!STANDARD?pyStream=MyAlerts" to get Audit Log information. The vendor states that this functionality was discover...

Cross site request forgery (csrf)

Various exposed resources of the ViewLogging class in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allow remote attackers to modify various settings via Cross-site request forgery CSRF...

CVE-2019-11585

The startup.jsp resource in Jira before version 7.13.6, from version 8.0.0 before version 8.2.3, and from version 8.3.0 before version 8.3.2 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect...

Crypto++ Unspecified Vulnerability

Crypto++ is a C++ cryptographic method library. A security vulnerability exists in Crypto++ 8.3.0 and earlier versions that can be exploited by an attacker to compute the private key used...

Advantech WebAccess/SCADA

CVSS v3 5.3 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Advantech Equipment: WebAccess/SCADA Vulnerabilities: Path Traversal, SQL Injection AFFECTED PRODUCTS The following versions of WebAccess/SCADA, a SCADA software platform, are affected: WebAccess/SCADA versions prior ...

动网(DVbbs) Ver 8.3.0 多个跨站漏洞

动网论坛做为目前国内最大的社区论坛软件服务提供商，依靠其强大的功能、非凡的访问速度和负载能力、友好方便的客户操作界面、优质的客户服务、国内领先的 技术和强大而持续的产品研发并保持不断创新的能力，动网所提供的动网社区论坛产品已经占据了国内社区论坛产品使用比例的70%以上。 目标网站对用户提交的变量代码未进行有效的过滤或转换，允许攻击者插入恶意WEB代码。 此版本新存在两处跨站漏洞 DVbbs Version 8.3.0 等待官方补丁 demo1:...

DVbbs < 8.3.0 dispbbs.asp跨站漏洞

DVBBS所有低于8.3.0的版本的page参数都具有一个通用跨站漏洞。 Dvbbs 7.1.X 与 8.2.X 之间的版本中，该跨站漏洞存在于dispbbs.asp中： http://www.example.com:80/dispbbs.asp?boardid=1&id=1&page="scriptaler t/liscker/;/script Dvbbs7.1.0 的版本中，该跨站漏洞存在于list.asp中： http://www.example.com:80/forum1/list.asp?boardid=1&id=1&page=scripta...