Joomla! cross-site request forgery vulnerability (CNVD-2020-09708)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. A cross-site request forgery vulnerability exists in Joomla! The vulnerability stems from the WEB application not adequately verifying that a reques...

Sitemagic CMS Cross-Site Request Forgery Vulnerability

Sitemagic CMS is a scalable content management system CMS. A cross-site request forgery vulnerability exists in Sitemagic CMS. An attacker could exploit the vulnerability to send unintended requests to the server via an affected client...

Sourcecodester Online Grading System Cross-Site Request Forgery Vulnerability

Sourcecodester Online Grading System is a student information management system. The system provides functions such as student information management and online grading. A cross-site request forgery vulnerability exists in the Sourcecodester Online Grading System. An attacker could use this...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-38805)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX. An attacker can exploit this...

CloudBees Jenkins iceScrum Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version of the release/test project and some timed tasks . iceScrum Plugin is used in which a projec...

OpenEMR Cross-Site Scripting Vulnerability (CNVD-2019-43372)

OpenEMR is a medical practice management software that also supports electronic medical records EMR. A reflected cross-site scripting vulnerability exists in interface/forms/eyemag/view.php in OpenEMR. An attacker can exploit this vulnerability to execute arbitrary code in the context of a user...

WordPress Server-Side Request Forgery Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress suffers from a server-side request forgery vulnerability. An attacker can exploit this vulnerability...

Open-Xchange OX App Suite Cross-Site Scripting Vulnerability (CNVD-2019-36981)

Open-Xchange OX App Suite is a set of Web-based cloud desktop environments from Open-Xchange USA. The environment allows users to manage email, tasks, files, etc. more intuitively. A cross-site scripting vulnerability exists in Open-Xchange OX App Suite versions 7.10.1 and 7.10.2. The vulnerabili...

UBUNTU-CVE-2019-17223

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php...

Intelbras Router WRN150 Cross-Site Scripting Vulnerability

The Intelbras Router WRN150 is a wireless router from Intelbras Brazil. A cross-site scripting vulnerability exists in the Intelbras Router WRN150. An attacker can exploit the vulnerability to execute arbitrary script code in the context of the affected site. This allows an attacker to steal...

cPanel Input Validation Error Vulnerability (CNVD-2019-36123)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An input validation error vulnerability exists in cPanel. Detailed vulnerability details are not available at this time...

PHPOK has an arbitrary file download vulnerability

PHPOK is a set of enterprise station CMS system developed in PHP + MYSQL language. PHPOK arbitrary file download vulnerability, attackers can use the vulnerability of any read, download files, access to sensitive information...

Atlassian Crowd XXE Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A security vulnerability exists in Atlassian Crowd versions prior to 3.0.2 and 3.1.0...

Atlassian Crowd Session Fixation Vulnerability

Atlassian Crowd is a Web-based single sign-on system from Atlassian Australia. The system provides authentication, authorization, and other functions for multiple users, web applications, and directory servers. A security vulnerability exists in Atlassian Crowd versions prior to 3.0.2 and 3.1.0...

PYSEC-2019-151

sendemail in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent ...

Design/Logic Flaw

Jiangnan Online Judge aka jnoj 0.8.0 has XSS via the Problemtitle parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create...

CVE-2018-21024

licenseUpload.php in Centreon Web before 2.8.27 allows attackers to upload arbitrary files via a POST request...

Sql injection

A vulnerability in the web-based interface of Cisco Unified Communications Manager and Cisco Unified Communications Manager Session Management Edition SME could allow an authenticated, remote attacker to impact the confidentiality of an affected system by executing arbitrary SQL queries. The...

CVE-2019-1915

CVE-2019-1915 affects Cisco Unified Communications Manager (CUCM), including SME, IM&P, and Unity Connection web interfaces. The root cause is insufficient CSRF protections, allowing an unauthenticated, remote attacker to trick a user into visiting a malicious page and issue arbitrary requests on...

Code Execution Vulnerabilities in the Background of Wild Rain Novel CMS

Wild Rain Fiction Content Management System provides a lightweight fiction website solution based on ThinkPHP 5.1+MySQL. Rain Novel cms backend code execution vulnerabilities , attackers can use the vulnerability to obtain server privileges...