silverstripe/framework sends passwords back to browsers under some circumstances

Under some circumstances a form may populate a PasswordField with submitted data, reflecting submitted data back to a user. The user will only see their own submissions for password data, which is not considered best practice. We are not aware of data leaks to other users, devices or sessions...

D-Link DIR-619 安全漏洞

The D-Link DIR-619L is a wireless router designed for home and small office environments, utilizing the IEEE 802.11n standard with a maximum transmission rate of 300Mbps. The D-Link DIR-619L suffers from a buffer overflow vulnerability that originates from the parameter webpage of goform/formWPS...

Sailthru Triggermail <= 1.1 - Reflected XSS

Description The plugin does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open: alert23' /...

U.S. Dept Of Defense: SQL injection on ██████████ via 'where' parameter

An SQL injection vulnerability was discovered in the 'where' parameter of the ArcGIS server. The vulnerability allowed an attacker to retrieve database content by injecting malicious SQL queries into the 'where' parameter. Esri released an update to ArcGIS Server 10.1 Service Pack 1 to address th...

The vulnerability of the ftpservlet component of the FileCatalyst Workflow software allows a perpetrator to execute arbitrary code.

The vulnerability of the ftpservlet component in the FileCatalyst Workflow software lies in errors during the processing of HTTP POST requests. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading specially crafted JSP files remotely...

PHP MySQL User Signup Login System SQL Injection Vulnerability

PHP MySQL User Signup Login System is a login and registration form using HTML, PHP and MySQL. A SQL injection vulnerability exists in PHP MySQL User Signup Login System version 1.0, which originates from a SQL injection vulnerability in the file /edit.php...

CVE-2024-24819

icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class gipfl\Web\Form is the base for various concrete form implementations 1 and provides protection against cross site request forgery CSRF by default. This is done by automatically...

PT-2024-20585 · Unknown · Icingaweb2-Module-Incubator

Name of the Vulnerable Software and Affected Versions: icingaweb2-module-incubator versions prior to 0.22.0 Description: The issue concerns the class gipflWebForm, which is the base for various concrete form implementations and provides protection against cross-site request forgery CSRF by defaul...

PT-2023-7731 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form...

Important: golang

Issue Overview: The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh. CVE-2023-24532 HTTP and MIME header...

OESA-2023-1621 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin 1. Create a "Service" and a "Provider" under the "gAppointments" sidebar menu. 2. Create a new form within Gravity...

CVE-2023-34831

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...

Design/Logic Flaw

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...

Turnitin LTI 跨站脚本漏洞

Turnitin LTI is the modern standard for integrating third-party tools with virtual learning environments. A security vulnerability exists in Turnitin LTI version 1.3 that stems from the vulnerability of the Submission Web Form to HTML injection attacks...

PT-2023-25018 · Turnitin · Turnitin Lti Tool

Name of the Vulnerable Software and Affected Versions: Turnitin LTI tool/plugin version 1.3 Description: The issue affects the "Submission Web Form" of the Turnitin LTI tool/plugin, where students submit their reports for similarity/plagiarism checks. Specifically, the submission web form is...

CVE-2023-34831

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...

CVE-2023-34831

The CVE-2023-34831 entry affects Turnitin LTI tool/plugin version 1.3, specifically the Submission Web Form. The vulnerability is HTML Injection via the id and title HTTP POST parameters used when students submit reports for similarity checks. Connected sources corroborate this HTML injection iss...

Faculty Evaluation System SQL Injection Vulnerability

Faculty Evaluation System is a faculty evaluation system. Faculty Evaluation System v1.0 suffers from a SQL injection vulnerability, which originates from a SQL injection in /eval/admin/viewfaculty.php?id. An attacker can exploit this vulnerability by inserting SQL commands into the query string ...

Loginizer 1.7.8 - Reflected XSS

The plugin does not escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page with the code below...