CVE-2020-27227

OpenClinic GA 5.173.3 is affected by an unauthenticated command injection. TALOS-2020-1203 documents that specially crafted requests to the server (notably POST to /openclinic/util/shell.jsp with parameters such as c=whoami) can execute commands, potentially exfiltrating the database and credenti...

CVE-2020-27233

CVE-2020-27233 concerns OpenClinic GA 5.173.3, where the supplierUID parameter in getAssets.jsp is vulnerable to SQL injection. The vulnerability is exploitable via an authenticated HTTP request, leading to potential arbitrary SQL execution. The connected sources (e.g., TALOS advisory, Red Hat en...

Simple Student Information System 1.0 - SQL Injection (Authentication Bypass) Vulnerability

Exploit Title: Simple Student Information System 1.0 - SQL Injection Authentication Bypass Exploit Author: Galuh Muhammad Iman Akbar GaluhID Vendor Homepage: https://www.sourcecodester.com/php/11400/simple-student-information-system-ajax-live-search.html Software Link:...

Classyfrieds <= 3.8 - Authenticated Arbitrary File Upload to RCE

The plugin does not properly check the uploaded file when an authenticated user adds a listing, only checking the content-type in the request. This allows any authenticated user to upload arbitrary PHP files via the Add Listing feature of the plugin, leading to RCE. POST /addalisting/ HTTP/1.1...

Vulnerability fixed in Forcepoint Web Security

A vulnerability has been fixed in Forcepoint Web Security. A malicious party can exploit the vulnerability to launch an XML External Entity Injection XXE attack when processing of XML data. An external attacker could exploit it to obtain sensitive information. Forcepoint has released updates to...

CVE-2020-6590

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure...

CVE-2020-6590

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure...

Information disclosure

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure...

CVE-2020-6590

Forcepoint Web Security Content Gateway versions prior to 8.5.4 improperly process XML input, leading to information disclosure...

CVE-2020-6590

CVE-2020-6590 affects Forcepoint Web Security Content Gateway versions prior to 8.5.4, where improper processing of XML input leads to information disclosure. The issue is rooted in XML handling (XML input processing) and can be triggered remotely over the network with low attack complexity; no u...

CVE-2021-30111

Web-School ERP 5.0 has a stored XSS vulnerability in the Add Events fields (event name and description). The underlying issue is that injected JavaScript is stored and executed when viewers open the affected events. Exploitation details (payloads, vectors) are not provided in the supplied documen...

Forcepoint Web Security Content Gateway 代码问题漏洞

Forcepoint Web Security Content Gateway is an application gateway from Forcepoint, USA. A code issue vulnerability exists in Forcepoint Web Security Content Gateway versions prior to 8.5.4 that stems from incorrectly processing XML input, which can lead to information disclosure...

School Registration And Fee System 1.0 Cross Site Scripting Vulnerability

Exploit Title: School Registration and Fee System | Multiple Stored Cross Site Scripting Exploit Author: Richard Jones Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/10932/school-registration-and-fee-system.html Version: 1.0 Tested On: Windows 1...

CVE-2021-28163

CVE-2021-28163 (Jetty symlink handling) is reported across multiple IBM advisories as a vulnerability in Eclipse Jetty where if the ${jetty.base} or ${jetty.base}/webapps directory is a symlink, an attacker could obtain the contents of the webapps directory. IBM documents list affected products s...

The vulnerability of Trend Micro InterScan Web Security Virtual Appliance lies in the recording beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Trend Micro InterScan Web Security Virtual Appliance is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

XSS Vulnerability in Heybbs Frontend

HEYBBS Micro Community is a bootstrap+php+mysqli based development program. Heybbs frontend has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

Path Traversal in mailtrain-org/mailtrain

✍️ Description A path traversal also known as directory traversal is a web security vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application code and data, credentials for back-end systems, and sensitive operating...

Cross-site Scripting (XSS) - Generic in maxsite/cms

✍️ Description Cross-site scripting also known as XSS is a web security vulnerability that allows an attacker to compromise the interactions that users have with a vulnerable application. It allows an attacker to circumvent the same origin policy, which is designed to segregate different websites...

Mozilla: Internal network hosts could have been probed by a malicious webpage

Using techniques that built on the slipstream research, a malicious webpage could have scanned both an internal network's hosts as well as services running on the user's local machine utilizing WebRTC connections. This vulnerability affects Firefox ESR 78.9, Firefox 87, and Thunderbird 78.9...

[ASA-202103-24] webkit2gtk: multiple issues

Arch Linux Security Advisory ASA-202103-24 ========================================== Severity: High Date : 2021-03-25 CVE-ID : CVE-2020-27918 CVE-2020-29623 CVE-2021-1765 CVE-2021-1789 CVE-2021-1799 CVE-2021-1801 CVE-2021-1870 Package : webkit2gtk Type : multiple issues Remote : Yes Link :...