CVE-2021-33807

Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData...

CVE-2021-33807: Improper Limitation of a Pathname to a Restricted Directory

Cartadis Gespage through 8.2.1 allows Directory Traversal in gespage/doDownloadData and gespage/webapp/doDownloadData...

PT-2021-20329

Name of the Vulnerable Software and Affected Versions: Cartadis Gespage versions 8.2.1 and earlier Description: The issue allows Directory Traversal in the "gespage/doDownloadData" and "gespage/webapp/doDownloadData" API endpoints. Recommendations: For Cartadis Gespage versions 8.2.1 and earlier,...

Cartadis Gespage 路径遍历漏洞

cartadis Cartadis Gespage is an application from cartadis Inc. a print management software that includes features such as print accounting, printer monitoring, user management, payments, quotas, and redirection rules for complete management of copies and prints. A path traversal vulnerability...

Mattermost: Specially crafted message request crashes the webapp for users who view the message

A specially crafted message request with a modified deletedat JSON parameter could crash the webapp for all users viewing the channel, or for anyone viewing a different channel if they switch to that channel afterward. This vulnerability could be exploited to prevent users from accessing a channe...

b2evolution 7.2.2 - (edit account details) Cross-Site Request Forgery Vulnerability

Exploit Title: b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery CSRF Exploit Author: Alperen Ergel @alpernae Vendor Homepage: https://b2evolution.net/ Software Link: https://b2evolution.net/downloads/7-2-2 Version : 7.2.2 Tested on: Kali Linux Category: WebApp Description...

b2evolution 7.2.2 Cross Site Request Forgery

Exploit Title: b2evolution 7.2.2 - 'edit account details' Cross-Site Request Forgery CSRF Exploit Author: Alperen Ergel @alpernae Vendor Homepage: https://b2evolution.net/ Software Link: https://b2evolution.net/downloads/7-2-2 Version : 7.2.2 Tested on: Kali Linux Category: WebApp Description...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc1) +22 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.0.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

org.cometd.java:cometd-java-examples (2.4.0.rc3), org.eclipse.jetty.aggregate:jetty-all (7.6.0.rc5) +46 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.0.rc5)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.cometd.java:cometd-java-examples 2.4.0.rc3 - org.eclipse.jetty.aggregate:jetty-all 7.6.0.rc...

org.eclipse.jetty.aggregate:jetty-all (7.5.0.rc0), org.eclipse.jetty.aggregate:jetty-all-server (7.5.0.rc0) +43 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.5.0.rc0)

org.eclipse.jetty:jetty-server MAVEN version 7.5.0.rc0 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.5.0.rc0 - org.eclipse.jetty.aggregate:jetty-all-server...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc6), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc6) +32 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.0.0.rc6)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc6 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc6 - org.eclipse.jetty.aggregate:jetty-all-server...

com.yammer.dropwizard:dropwizard-client (0.1.0), com.yammer.dropwizard:dropwizard-core (0.1.0) +69 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.0 - com.yammer.dropwizard:dropwizard-core 0.1.0 -...

org.eclipse.jetty.aggregate:jetty-all (8.1.0.rc1), org.eclipse.jetty.aggregate:jetty-all-server (8.1.0.rc1) +42 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (8.1.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 8.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 8.1.0.rc1 - org.eclipse.jetty.aggregate:jetty-all-server...

com.qualinsight.plugins.jetty:qualinsight-plugins-jetty-7.6.x (>=1.0.1, <=1.0.2), org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (>=1.4.15, <=1.6.7) +39 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.6.17.v20150415)

org.eclipse.jetty:jetty-server MAVEN version 7.6.17.v20150415 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.qualinsight.plugins.jetty:qualinsight-plugins-jetty-7.6.x =1.0.1, =1.4.15, =1.6.7 -...

org.eclipse.jetty.aggregate:jetty-all (7.0.0.rc2), org.eclipse.jetty.aggregate:jetty-all-server (7.0.0.rc2) +28 more potentially affected by CVE-2021-34428 via org.eclipse.jetty:jetty-server (7.0.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.0.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.eclipse.jetty.aggregate:jetty-all 7.0.0.rc2 - org.eclipse.jetty.aggregate:jetty-all-server...

CVE-2021-32683

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

CVE-2021-32683

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

Cross site scripting

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

CVE-2021-32683 XSS through createObjectURL

wire-webapp is the web version of Wire, an open-source messenger. A cross-site scripting vulnerability exists in wire-webapp prior to version 2021-06-01-production.0. If a user is instructed to open an image in a new tab right click - open in new tab, or copy the URL and paste it in the URL bar, ...

CVE-2021-32683

Affected software: wire-webapp (web version of Wire). Vulnerability: cross-site scripting (CVE-2021-32683) present in versions prior to 2021-06-01-production.0 due to image handling (createObjectURL) that can execute malicious code on app.wire.com when an image is opened in a new tab or URL paste...