892 matches found
Mail.ru: Reflected XSS at city-mobil.ru
Reflected XSS via URI vector in https://city-mobil.ru/ 404 response...
CVE-2019-10227
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
CVE-2019-10227
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
Cross site scripting
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
CVE-2019-10227
openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component...
CVE-2019-10227
openITCOCKPIT before 3.7.1 is affected by a reflected XSS in the 404-not-found component. The CVE details confirm the issue (XSS) and that a fixed version is 3.7.1. The vulnerability is non-authenticated per CVSS2/3.1 vectors, with impact to integrity. Publicly documented remediation is upgrading...
Siemens Desigo PX 6.00 - Denial of Service (PoC)
Title: Siemens Desigo PX 6.00 - Denial of Service PoC Author: LiquidWorm Date: 2019-11-14 Vendor web page: https://www.siemens.com Product web page: https://new.siemens.com/global/en/products/buildings/automation/desigo.html Affected version:6.00 Affected version: Model: PXC00-E.D, PXC50-E.D,...
Siemens Desigo PX 6.00 Denial Of Service
!/bin/bash Siemens Desigo PX V6.00 Web Remote Denial of Service Exploit Vendor: Siemens AG Vendor web page: https://www.siemens.com Product web page: https://new.siemens.com/global/en/products/buildings/automation/desigo.html Affected version: Model: PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D...
GSA Bounty: Cache poisoning DoS to various TTS assets
I have recently come across a technique to force a Cloudfoundry app to return a HTTP 404 error when requesting any resource, which contains cache friendly headers. What this means is, if the Cloudfoundry app in question is behind a web cache like Cloudfront or Cloudflare etc, it will possibly sto...
CVE-2019-17224
The web interface of the Compal Broadband CH7465LG modem version CH7465LG-NCIP-6.12.18.25-2p6-NOSH is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of th...
Path traversal
The web interface of the Compal Broadband CH7465LG modem version CH7465LG-NCIP-6.12.18.25-2p6-NOSH is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of th...
Starbucks: WAF bypass via double encoded non standard ASCII chars permitted a reflected XSS on response page not found pages - (629745 bypass)
Summary: Report 629745 not properly resolved: "Many Starbucks websites are vulnerable to cross-site scripting on 404 pages because double quotes lack sanitizing in hidden input tags, which leads to JavaScript execution". Description: Report 629745 caught my attention, so I began testing the WAF t...
WordPress custom-404-pro plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. custom-404-pro is a 404 page customization plugin used in it. A cross-site scripting vulnerability exists in WordPress custom-404-pro...
CVE-2019-15838
The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS, a different vulnerability than CVE-2019-14789...
CVE-2019-15838
The CVE-2019-15838 entry concerns the WordPress plugin custom-404-pro prior to version 3.2.8, where reflected XSS affects user input, per multiple sources (NVD, Red Hat, CNVD/PRION references). Remediation shown in related documents is to update to version 3.2.8 or later. The vulnerability is spe...
PT-2019-14427 · WordPress · Custom 404 Pro
Name of the Vulnerable Software and Affected Versions: custom-404-pro plugin versions prior to 3.2.8 Description: The issue is related to reflected XSS. Recommendations: For versions prior to 3.2.8, update to version 3.2.8 or later to resolve the issue...
CVE-2019-4132
IBM Cloud Automation Manager 3.1.2 could allow a user to be impropertly redirected and obtain sensitive information rather than receive a 404 error message. IBM X-Force ID: 158274...
ZEIT: Unauthorized admission to any team in zeit.co
step no.1: open : https://zeit.co/teams/invite/ XXXX and this is a code "CzKyCgbB" of joining in a team called "maxhacker" if we generate a list consists of 8 capital and small letters with any generate tools F565462 knowing that the invitation code of any team is constant...
WordPress 404-to-301 Plugin SQL Injection Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. 404-to-301 is a plugin used to redirect 404 pages to other pages. The WordPress 404-to-301 plugin suffers from a SQL injection...
