BookStack 代码问题漏洞

BookStack is an open source platform for building wiki documentation using PHP and Laravel from the BookStackApp Bookstackapp team. Bookstack has a code issue vulnerability that arises from improper design or implementation during code development of a web-based system or product...

Wire 代码问题漏洞

Wire is a chat software by an individual developer. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original greeting method, PING. Wire suffers from a security vulnerability. An attacker can pass a malicious payloa...

Design/Logic Flaw

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the...

CVE-2021-29440

Grav CMS 1.7.x is affected by CVE-2021-29440 due to unsandboxed Twig processing of static pages enabled via front matter by users with page-creation/admin privileges. The vulnerability enables server-side template injection, which can lead to arbitrary code execution and privilege escalation on t...

Viki Solutions Viki Vera 跨站脚本漏洞

Viki Solutions Viki Vera is a suite of workflow customization platforms from Canadian company Viki Solutions. The platform supports file uploading, job management, and other features. A security vulnerability exists in Viki Vera 4.9.1.26180, which can be exploited by an attacker to set a user's...

SQL Injection Vulnerability in OneKey Education Cloud Disk Service Platform of Orient Boguan (Beijing) Technology Co.

The OneKey Education Cloud Disk Service Platform supports multiple platforms such as Web, PC, and Android cell phone clients for cross-platform and cross-terminal file sharing and anytime, anywhere access. There is a SQL injection vulnerability in the OneKey Education Cloud Disk Service Platform ...

CVE-2020-9309

SilverStripe CMS up to version 4.5 is vulnerable to script execution via malicious upload contents, when files with allowed extensions are stored as protected or draft and MIME detection causes browsers to run the file contents. Affected component/file: uploads handling (protected/draft state) an...

CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

CVE-2020-9280

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

CVE-2020-9280: Unrestricted Upload of File with Dangerous Type

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

Eight images with SQL injection vulnerability

Eight Pictures is a web platform that allows you to encrypt pictures with QR codes. Eight Pictures suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information from the database...

SQL Injection Vulnerability in Shop7z Online Shopping System Fashion Edition of Shijiazhuang Zhenghong Network Technology Co.

Shop7z online shopping system is ASP online store platform software. Shijiazhuang City Zhenghong Network Technology Co., Ltd Shop7z online shopping system fashion version of the existence of SQL injection vulnerability, an attacker can use the vulnerability to obtain sensitive information in the...

SQL injection vulnerability in SeaCMS backend (CNVD-2019-45354)

SeaCMS is a station building system based on PHP+MYSQL architecture and supports cross-platform operation. There is a SQL injection vulnerability in the background of SeaCMS, which can be exploited by attackers to obtain sensitive database information...

cPanel Competitive Conditions Issue Vulnerability

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A Competing Conditions Issue vulnerability exists in versions of cPanel prior to 58.0.4. The vulnerability stems from improper...

cPanel Authorization Issues Vulnerability (CNVD-2019-36126)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An authorization issue vulnerability exists in cPanel. Detailed vulnerability details are not available at this time...

SWIFT Alliance Web Platform Unauthorized File Modification Vulnerability

SWIFT Alliance Web Platform is SWIFT Belgium's suite of graphical user interface software for the SWIFT Alliance family of products. A security vulnerability exists in SWIFT Alliance Web Platform version 7.1.23. An attacker could exploit the vulnerability to tamper with log file names and error l...

JetBrains YouTrack server code execution vulnerability

JetBrains YouTrack is a browser-based bug tracking and project management software from the Czech company JetBrains. The software features bug tracking, creating workflows and monitoring project progress. A code execution vulnerability exists in the JetBrains YouTrack server. The vulnerability...

CVE-2018-16386

An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection and an arbitrary log filename can be achieved via the PATHINFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error...

Design/Logic Flaw

An issue was discovered in SWIFT Alliance Web Platform 7.1.23. A log injection and an arbitrary log filename can be achieved via the PATHINFO to swp/login/EJBRemoteService/, related to com.swift.ejbgwt.j2ee.client.EjBlnvocationException error log information containing null@java:comp/env/ error...