Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9.
LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a special field in JSON documents to cast different types from `BsonDocument` to POCO classes. When instances of an object are not the same of class, `BsonMapper` use a special field `_type` string info with full class name with assembly to be loaded and fit into your model. If your end-user can send to your app a plain JSON string, deserialization can
У нас на производстве уже несколько лет работает "самодельная" система контроля за простоями на производстве, реализованная на базе MS SQL, SQL Server Reporting Services и IIS. Поскольку эта система довольно старая и не очень хорошо приспособлена для современных браузеров, мне захотелось попробовать ради эксперимента сделать что-то похожее на базе SQlite, c# и javascript. Читать далее
С началом торговой войны между Китаем и США оба государства стали активно развивать электронную промышленность в собственных границах. Китаю при этом приходится гораздо сложнее, поскольку страна находится под очень сильным санкционным давлением Штатов. Тем не менее,…
An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /urule/common/saveFile.
Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.php.
SQL injection vulnerability in sourcecodester mobile-shop-system-php-mysql 1.0 allows remote attackers to log in via crafterdstring in the email field of the log in page.
SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremeter in application URL.
File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog page.
The WP Meta SEO plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.5.3. This is due to missing or incorrect nonce validation on the regenerateSitemaps function. This makes it possible for unauthenticated attackers to regenerate Sitemaps via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.