Cross site scripting

A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10b202303061504. This issue affects the function runaction of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument requestpath leads ...

CVE-2023-3085 X-WRT luci 404 Error Template dispatcher.uc run_action cross site scripting

A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10b202303061504. This issue affects the function runaction of the file modules/luci-base/ucode/dispatcher.uc of the component 404 Error Template Handler. The manipulation of the argument requestpath leads ...

K41412302: Jetty vulnerability CVE-2019-10247

Security Advisory Description In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not...

K10204425: PHP vulnerability CVE-2018-5712

Security Advisory Description An issue was discovered in PHP before 5.6.33, 7.0.x before 7.0.27, 7.1.x before 7.1.13, and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file. CVE-2018-5712 Impact There is no impact; F5 products are not...

generator-hottowel Cross-site Scripting vulnerability

A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

CVE-2016-15025

A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

CVE-2016-15025

A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

Cross site scripting

A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

CVE-2016-15025

The CVE-2016-15025 entry concerns generator-hottowel 0.0.11. Affected is an unknown function in app/templates/src/server/_app.js (404 Error Handler). The issue allows cross-site scripting and can be exploited remotely. A patch named c17092fd4103143a9ddab93c8983ace8bf174396 is available; applying ...

CVE-2016-15025 generator-hottowel 404 Error _app.js cross site scripting

A vulnerability, which was classified as problematic, was found in generator-hottowel 0.0.11. Affected is an unknown function of the file app/templates/src/server/app.js of the component 404 Error Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

New Timing Attack Against NPM Registry API Could Expose Private Packages

A novel timing attack discovered against the npm's registry API can be exploited to potentially disclose private packages used by organizations, putting developers at risk of supply chain threats. "By creating a list of possible package names, threat actors can detect organizations' scoped privat...

SEO Redirection < 9.1 - 404 Error & History Deletion via CSRF

The plugin does not have CSRF check when deleting 404 errors and history, which could allow attackers to make logged in admins delete them via CSRF attacks...

Shopify: DoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.com

There was a web cache poisoning vulnerability on Shopify's CDN domains that allowed an attacker to block access to any file hosted on the website. The vulnerability existed because the cache server treated backslashes and forward slashes as equivalent, while the origin server returned 404 errors...

Malicious Package

Overview website-404-error-page is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

404s < 3.5.1 - Admin+ Stored Cross-Site Scripting

Description The plugin does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create/edit a new 404 via the plugin and put the following payload in the "Please enter th...

Malicious code in website-404-error-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73bf65ffbe607175a82640f4548763aeb97f1f0e322c0735470fdccd5d757e43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-836P-6P4J-35CG Drupal Open Redirect

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging 1 custom code or 2 a form shown on a 404 error page, related to path manipulation...

GHSA-H847-63FG-VM6C nZEDb Cross-site Scripting (XSS) in the 404 error page

nZEDb before 0.8.0.0 has XSS in the 404 error page...

nZEDb Cross-site Scripting (XSS) in the 404 error page

nZEDb before 0.8.0.0 has XSS in the 404 error page...

Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in...