CVE-2020-19156: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in Ari Adminer v1 allows remote attackers to execute arbitrary code via the 'Title' parameter of the 'Add New Connections' component when the 'save' function is called...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress...

KnockOutlook - A Little Tool To Play With Outlook

"The best feeling is to win by knockout." - Nonito Donaire Overview KnockOutlook is a C project that interacts with Outlook's COM object in order to perform a number of operations useful in red team engagements. Command Line Usage metadata of every account search : search for the provided keyword...

rConfig 跨站脚本漏洞

rConfig is an open source network configuration management utility. rConfig version 3.9.5 contains a cross-site scripting vulnerability that can be exploited by remote attackers to execute arbitrary JavaScript code by entering a specific payload and saving it...

CVE-2021-34645

The Shopping Cart & eCommerce Store WordPress plugin is vulnerable to Cross-Site Request Forgery via the savecurrencysettings function found in the /admin/inc/wpeasycartadmininitialsetup.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 5.1.0...

PT-2021-20613

Name of the Vulnerable Software and Affected Versions: The Shopping Cart & eCommerce Store WordPress plugin versions up to and including 5.1.0 Description: The issue is related to Cross-Site Request Forgery, allowing attackers to inject arbitrary web scripts via the save currency settings functio...

CVE-2020-25566

In SapphireIMS 5.0, it is possible to take over an account by sending a request to the SavePassword form as shown in POC. Notice that we do not require a JSESSIONID in this request and can reset any user’s password by changing the username to that user and password to base64desired password...

CVE-2020-25564

In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessing RemoteMgmtTaskSave Automation Tasks feature...

SapphireIMS 访问控制错误漏洞

Tecknodreams SapphireIMS is an ITIL 2011 certified Enterprise Service Management System from Tecknodreams India. A security vulnerability exists in SapphireIMS 5.0, which stems from the software's Save Password form not filtering requests enough to allow an attacker to send a request to take over...

PT-2021-11153

Name of the Vulnerable Software and Affected Versions: SapphireIMS version 5.0 Description: The issue allows for account takeover by sending a request to the "Save Password" form. This can be done without requiring a JSESSIONID, enabling the reset of any user's password by modifying the username ...

CVE-2021-24467: Cross-Site Request Forgery (CSRF)

The Leaflet Map WordPress plugin before 3.0.0 does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the...

PT-2021-10212 · Unknown · Ignited Cms

Name of the Vulnerable Software and Affected Versions: IgnitedCMS version 1.0 Description: The issue allows remote attackers to obtain sensitive information and gain privilege via the component "/admin/profile/save profile". This is a Cross Site Request Forgery CSRF issue, which can be exploited ...

CVE-2021-34631

The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handlesavestyle function found in the /news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18...

PT-2021-20599

Name of the Vulnerable Software and Affected Versions: NewsPlugin WordPress plugin versions up to and including 1.0.18 Description: The issue allows attackers to inject arbitrary web scripts via Cross-Site Request Forgery, leveraging the handle save style function found in the /news-plugin.php...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

OSV-2021-1074 Use-of-uninitialized-value in SkBaseDevice::save

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36647 Crash type: Use-of-uninitialized-value Crash state: SkBaseDevice::save SkCanvas::internalSave SkCanvas::internalSaveLayer...

PT-2021-27678

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by the use of an uninitialized value. The crash occurs in the SkBaseDevice::save function, which is called by...

DevSecOps Training - Data Center Attack: The Game

See what it’s like as a security decision maker in Data Center Attack: The Game. Will your decisions help save lives?...

CVE-2021-26230

Cross-site scripting XSS vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to saveuser.php...

PT-2021-16971

Name of the Vulnerable Software and Affected Versions SourceCodester CASAP Automated Enrollment System version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via the user information to "save user.php". This can lead to cross-site scripting XSS attacks...