15159 matches found
Code injection
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post...
CVE-2021-37863
Mattermost 6.0 and earlier are affected by an input validation issue during post creation. The vulnerability allows an authenticated attacker to trigger a client-side crash of the web app via a maliciously crafted post. Public sources consistently describe the issue as arising from insufficient v...
CVE-2021-37863
Mattermost 6.0 and earlier fails to sufficiently validate parameters during post creation, which allows authenticated attackers to cause a client-side crash of the web application via a maliciously crafted post...
Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2022-04999)
Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...
ThinkPHP SQL Injection Vulnerability (CNVD-2021-103660)
ThinkPHP is a set of PHP-based, open source, lightweight Web application development framework from China Top Think Information Technology. thinkPHP has SQL injection vulnerability, there is no detailed vulnerability details provided...
Adobe Experience Manager Cross-Site Scripting Vulnerability
Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...
laravel-filemanager 代码问题漏洞
laravel-filemanager is an open source tool from UniSharp. A code issue vulnerability exists in laravel-filemanager that stems from the upload function not adequately validating the file type during upload. An attacker can replicate the following steps to exploit the vulnerability:Install a packag...
Online Magazine Management System SQL Injection Vulnerability
Online Magazine Management System is an open source PHP-based web application where users can share their magazines. Online Magazine Management System is vulnerable to SQL injection, which can be exploited by attackers to gain access to the application as an administrator...
Adobe Experience Manager cross-site scripting vulnerability (CNVD-2021-102798)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
Galette Cross-Site Request Forgery Vulnerability
Galette is open source a membership management web application for non-profit organizations. Galette suffers from a cross-site request forgery vulnerability that stems from a failure to check for cross-site request forgery attacks in Galette version 0.9.6 and earlier. No details of the...
PT-2021-21895 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 6.0 and earlier Description: The issue arises from insufficient validation of parameters during post creation, allowing authenticated attackers to cause a client-side crash of the web application via a maliciously crafted...
CVE-2021-41261
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been...
Cross site scripting
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been...
CVE-2021-41261
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 are subject to stored cross site scripting attacks via the preferences footer. The preference footer can only be altered by a site admin. This issue has been...
Ransom DDoS Enters its Fourth Wave
Extortionists target industries with most to lose from an outage Cybercriminals continue to target organizations threatening Denial of Service DDoS attacks in exchange for a ransom payment, traditionally demanded in bitcoin BTC. And it seems that no matter how many times these ransom threat cycle...
CVE-2021-41260
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue...
CVE-2021-41260
Galette is a membership management web application built for non profit organizations and released under GPLv3. Versions prior to 0.9.6 do not check for Cross Site Request Forgery attacks. All users are advised to upgrade to 0.9.6 as soon as possible. There are no known workarounds for this issue...
CVE-2021-41261
CVE-2021-41261 affects Galette prior to version 0.9.6, where a stored cross-site scripting vulnerability exists in the preferences footer that can be modified by a site admin. The issue has been fixed in 0.9.6; upgrade all installations to that release. The public sources confirm the vulnerabilit...
CVE-2021-41260
CVE-2021-41260 affects Galette, a PHP-based membership management app. The issue is missing Cross-Site Request Forgery (CSRF) protections in versions prior to 0.9.6. Public disclosures from multiple sources (NVD, Red Hat, Ubuntu, CNVD, OSV) all state no CSRF checks exist before 0.9.6 and recommen...
