EUVD-2019-7848

Malware in sbrugna...

CVE-2019-17490

app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge aka jnoj 0.8.0 allows arbitrary file upload, as demonstrated by PHP code with a .php filename but the image/png content type to the web/polygon/problem/tests URI...

CVE-2019-17538

Jiangnan Online Judge aka jnoj 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring...

PT-2019-15196

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue allows for Directory Traversal, enabling file reading via a specific substring in the "web/polygon/problem/viewfile" endpoint, such as "id=1&name=../". Recommendations For...

CVE-2019-17537: Improper Limitation of a Pathname to a Restricted Directory

Jiangnan Online Judge aka jnoj 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring...

PT-2019-15195

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue allows for Directory Traversal, which can be exploited for file deletion. This is achieved through a specific substring in the "web/polygon/problem/deletefile" API endpoint,...

CVE-2019-17491

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemdescription parameter to web/admin/problem/create or web/polygon/problem/update...

Design/Logic Flaw

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemsampleinput parameter to web/admin/problem/create or web/polygon/problem/update...

CVE-2019-17489

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemtitle parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create...

CVE-2019-17489

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemtitle parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create...

CVE-2019-17490

app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge aka jnoj 0.8.0 allows arbitrary file upload, as demonstrated by PHP code with a .php filename but the image/png content type to the web/polygon/problem/tests URI...

CVE-2019-17491

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemdescription parameter to web/admin/problem/create or web/polygon/problem/update...

CVE-2019-17493

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemsampleinput parameter to web/admin/problem/create or web/polygon/problem/update...

CVE-2019-17490: Unrestricted Upload of File with Dangerous Type

app\modules\polygon\controllers\ProblemController in Jiangnan Online Judge aka jnoj 0.8.0 allows arbitrary file upload, as demonstrated by PHP code with a .php filename but the image/png content type to the web/polygon/problem/tests URI...

CVE-2019-17491: Improper Neutralization of Input During Web Page Generation

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemdescription parameter to web/admin/problem/create or web/polygon/problem/update...

PT-2019-15167

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue concerns a security problem where an attacker can execute malicious scripts. This is possible due to the lack of proper input validation in the Problemdescription parameter. Th...

PT-2019-15164

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue concerns a security problem where an attacker can execute malicious scripts on the website. This is achieved through the Problemtitle parameter in specific API endpoints, such ...

PT-2019-15168

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue concerns an XSS vulnerability. It can be exploited via the sample input parameter in specific API endpoints, such as "web/admin/problem/create" or "web/polygon/problem/update"...

CVE-2019-17493: Improper Neutralization of Input During Web Page Generation

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemsampleinput parameter to web/admin/problem/create or web/polygon/problem/update...

PT-2019-15166

Name of the Vulnerable Software and Affected Versions Jiangnan Online Judge aka jnoj version 0.8.0 Description The issue allows for arbitrary file upload. This can be achieved by uploading PHP code with a .php filename but setting the content type to image/png, and sending it to the...