Tag
#csrf
DriverPack Solution CMS version 17.11.108 suffers from a cross site scripting vulnerability.
Desenvolvido C3iM CMS version 2.0 suffers from a cross site scripting vulnerability.
Deprixa version 3.2.5 suffers from a cross site request forgery vulnerability.
A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1.
A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense before 23.7 allows attackers to execute arbitrary system commands.
PHPJabbers Vacation Rental Script version 4.0 suffers from a cross site request forgery vulnerability.
eHato CMS version 1.0 suffers from a cross site scripting vulnerability.
## Command Injection in docker fetch process ### Summary A possible command injection in the docker fetch process as it allows to append malicious commands in the docker_reference parameter. ### Details In the function `scanpipe/pipes/fetch.py:fetch_docker_image`[1] the parameter `docker_reference` is user controllable. The `docker_reference` variable is then passed to the vulnerable function `get_docker_image_platform`. ```python def fetch_docker_image(docker_reference, to=None): """ code snipped .... """ platform_args = [] platform = get_docker_image_platform(docker_reference) # User controlled `docker_reference` passed """ code snipped... """ ``` However, the `get_docker_image_plaform` function constructs a shell command with the passed `docker_reference`. The `pipes.run_command` then executes the shell command without any prior sanitization, making the function vulnerable to command injections. ```python def get_docker_image_platform(docker_refer...
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php.