CVE-2021-34821

CVE-2021-34821 affects AAT Novus Management System (NMS) up to version 1.51.2. The WebUI improperly handles 404s, allowing a remote, unauthenticated attacker to issue requests to non-existent URIs. The vulnerability stems from the URL path filename being copied into the HTML document as plain tex...

CVE-2021-34821

Cross Site Scripting XSS vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote, unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL...

CVE-2021-35300

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

CVE-2021-35300

Text injection/Content Spoofing in 404 page in Zammad 1.0.x up to 4.0.0 could allow remote attackers to manipulate users into visiting the attackers' page...

CVE-2019-25047

Greenbone Security Assistant GSA before 8.0.2 and Greenbone OS GOS before 5.0.10 allow XSS during 404 URL handling in gsad...

CVE-2019-25047

Greenbone Security Assistant GSA before 8.0.2 and Greenbone OS GOS before 5.0.10 allow XSS during 404 URL handling in gsad...

Cross site scripting

Greenbone Security Assistant GSA before 8.0.2 and Greenbone OS GOS before 5.0.10 allow XSS during 404 URL handling in gsad...

CVE-2019-25047

Greenbone Security Assistant GSA before 8.0.2 and Greenbone OS GOS before 5.0.10 allow XSS during 404 URL handling in gsad...

Greenbone Security Assistant 跨站脚本漏洞

Greenbone Security Assistant GSA is a web interface.Greenbone Security Assistant is a web interface developed for the Greenbone Security Manager appliance. A cross-site scripting vulnerability exists in Greenbone Security Assistant GSA versions prior to 8.0.2 and Greenbone OS GOS versions prior t...

Ping Identity: Broken Link on Ping Identity's Vulnerability Submission Form on Hackerone

Summary: Ping Identity has an unclaimed broken link on their HackerOne security page which can be claimed by any malicious user, who could then exploit this issue with clever social engineering to deceive new researchers to submit their legitimate findings to the wrong hands. Similar to this...

Lucee < 5.3.5.96, 5.3.6.x < 5.3.6.68, 5.3.7.x < 5.3.7.47 RCE Vulnerability (GHSA-2xvv-723c-8p7r) - Active Check

Lucee is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:lucee:luceeserver";...

CVE-2021-31641

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated...

Design/Logic Flaw

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated...

CVE-2021-31641

ChiYu IoT devices BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W and SEMAC are affected by an unauthenticated XSS vulnerability. The root cause is lack of sanitization when generating HTTP 404 responses, enabling remote scripting via network access. Public documentation con...

CVE-2021-31641

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated...

CHIYU科技BF-630W 跨站脚本漏洞

BF-630W is a web-based fingerprint-secured single-door biometric reader controller from CHIYU Technology CHIYU Technology suffers from a cross-site scripting vulnerability that stems from an unauthenticated XSS vulnerability in several CHIYU Technology IoT devices, including BF-630, BF-450M,...

WordPress All 404 Redirect to Homepage plugin <= 1.21 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress All 404 Redirect to Homepage plugin versions = 1.21. Solution Update the WordPress All 404 Redirect to Homepage plugin to the latest available version at least 2.1...

CHIYU BF-630W 跨站脚本漏洞

BF-630W is a web-based fingerprint-secured single-door biometric reader controller from CHIYU Technology CHIYU Technology suffers from a cross-site scripting vulnerability that stems from an unauthenticated XSS vulnerability in several CHIYU Technology IoT devices, including BF-630, BF-450M,...

Design/Logic Flaw

Http4s is a Scala interface for HTTP services. StaticFile.fromUrl can leak the presence of a directory on a server when the URL scheme is not file://, and the URL points to a fetchable resource under its scheme and authority. The function returns FNone, indicating no resource, if url.getFile is a...

WordPress plugin cross-site scripting vulnerability (CNVD-2021-37473)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in versions o...