Henri Salo

The anti-traversal code implemented in the filemanager.php of OpenCart is ineffective and can be bypassed.

The issue allows for arbitrary file upload via the upload.php file. This can potentially lead to unauthorized access and malicious activities on the affected system.

The issue allows file upload and arbitrary PHP code execution through the Tiny browser in the TinyMCE 3.0 editor.

The issue concerns a cross-site scripting (XSS) vulnerability in the `date` parameter of the `admin-news-articles.php` file. This allows for potential malicious script injection. No information is provided about the estimated number of affected devices or real-world incidents.

The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the `search terms` parameter in the "search.php" file.

Name of the Vulnerable Software and Affected Versions: WordPress plugin wp-cleanfix (affected versions not specified) Description: The issue is related to Remote Code Execution in the WordPress plugin wp-cleanfix. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows for an automated mail timeout bypass.

The issue allows information disclosure due to weak encryption.

Name of the Vulnerable Software and Affected Versions: Flippy module versions 7.x-1.x before 7.x-1.2 for Drupal Description: The issue allows remote authenticated users with the permission to access content to read a link or alias to a restricted node due to improper access restriction to nodes. Recommendations: For Flippy module versions 7.x-1.x before 7.x-1.2, update to version 7.x-1.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Havalite CMS version 1.1.7 Description: The issue is related to a stored XSS vulnerability. Recommendations: For Havalite CMS version 1.1.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns an unspecified remote code execution in ImpressPages CMS. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation are not specified.

The issue is related to a Cross-Site Scripting (XSS) vulnerability. Cross-Site Scripting is a type of security vulnerability that occurs when an attacker is able to inject malicious scripts into a website, which are then executed by the user's browser.

The issue is a SQL injection vulnerability.

The issue allows remote attackers to inject arbitrary SQL statements, which is a type of SQL injection vulnerability. This means an attacker can execute unauthorized SQL code on the database, potentially leading to data manipulation or extraction.

A backdoor was found in PyForum where an attacker who knows a valid user email could force a password reset on behalf of that user.

The issue is related to a missing JEXEC check. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

A Cross-Site Scripting (XSS) issue exists in the reorder administrator functions. This allows for potential malicious script execution.

The issue is related to a Cross-Site Scripting (XSS) problem. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized access or control.

The issue is a local buffer overflow.

The issue allows an attacker to modify a ticket's status and resolution without proper permissions due to inadequate workflow permission checks.