17016 matches found
GPT Academic 安全漏洞
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited ...
UBUNTU-CVE-2024-10004
Opening an external link to an HTTP website when Firefox iOS was previously closed and had an HTTPS tab open could in some cases result in the padlock icon showing an HTTPS indicator incorrectly This vulnerability affects Firefox for iOS 131.2...
CVE-2024-41344
A Cross-Site Request Forgery CSRF in Codeigniter 3.1.13 allows attackers to arbitrarily change the Administrator password and escalate privileges...
GHSA-2234-FMW7-43WR Hono allows bypass of CSRF Middleware by a request without Content-Type header.
Summary Bypass CSRF Middleware by a request without Content-Type herader. Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe...
PT-2024-9767
Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 131.2 Firefox iOS affected versions not specified, but versions under 131.2 are known to be affected Description: The issue is related to the incorrect display of HTTPS indicators in the Firefox browser for...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially crafte...
IncidentReporting 安全漏洞
IncidentReporting is an open source MediaWiki-based incident reporting form from Miraheze. IncidentReporting has a security vulnerability that stems from various cross-site scripting issues...
New Case Study: The Evil Twin Checkout Page
Is your store at risk? Discover how an innovative web security solution saved one global online retailer and its unsuspecting customers from an "evil twin" disaster. Read the full real-life case study here. The Invisible Threat in Online Shopping When is a checkout page, not a checkout page? When...
PhpSpreadsheet 跨站脚本漏洞
PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. A cross-site scripting vulnerability exists in PhpSpreadsheet that stems from improper handling of input...
SeedDMS 跨站脚本漏洞
SeedDMS is SeedDMS open source PHP and MySql based on a set of open source document management system . The system is mainly used to store and share documents . SeedDMS v6.0.28 version of the existence of cross-site scripting vulnerability , the vulnerability stems from the application of the...
Cross-site Scripting (XSS)
Overview NuGetGallery is a Core support library for NuGet Gallery Frontend and Backend. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the handling of HTML element attributes. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Summary A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. Details Here's the offending line:...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ColorColumn and ColorEntry components, when the values passed are not valid, containing a specific set of characters. Details Cross-site scripting or XSS is a code vulnerability that occurs when an...
Ellevo Cross-Site Scripting Vulnerability
Ellevo is an enterprise process-oriented software from Ellevo. A cross-site scripting vulnerability exists in Ellevo version 6.2.0.38160, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to execute arbitrary Web...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Page URL variable. An attacker can manipulate web content or hijack user sessions by injecting malicious scripts into the URL parameter. Details Cross-site scripting or XSS is a code vulnerability th...
CVE-2024-46086
FrogCMS V0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/plugin/filemanager/delete/123...
mozilla: SelectElements could be shown over another site if popups are allowed
The Mozilla Foundation's Security Advisory: If a site had been granted permission to open popup windows, it could cause Select elements to appear on top of another site to perform a spoofing attack...
Vite 访问控制错误漏洞
Vite is a new front-end builder tool from the Vite open source. Vite suffers from an access control error vulnerability that stems from the fact that the contents of any file can be returned to the browser...