5281 matches found
CVE-2022-22112 DayByDay CRM - Application-Wide Client-Side Template Injection (CSTI)
In DayByDay CRM, versions 1.1 through 2.2.1 latest suffer from an application-wide Client-Side Template Injection CSTI. A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser...
The vulnerability of the Apache module for web application security enhancement, modsecurity-apache, related to errors in processing JSON objects, allows attackers to cause service failures.
The vulnerability of the Apache module for enhancing web application security, modsecurity-apache, is related to errors in processing JSON objects. Exploiting this vulnerability can allow a malicious actor to perform a denial-of-service attack...
Tenable SecurityCenter < 5.20.0 Multiple Vulnerabilities (TNS-2022-01)
According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.20.0 and is therefore affected by multiple vulnerabilities: - A crafted URI sent to httpd configured as a forward proxy ProxyRequests on can cause a crash NULL pointer...
Projeqtor 9.3.1 Cross Site Scripting Vulnerability
Exploit Title: Projeqtor v9.3.1 Stored XSS / Privilege Escalation Exploit Author: Oscar Gutierrez m4xp0w3r Vendor Homepage: https://www.projeqtor.org/en/ Software Link: https://www.projeqtor.org/en/product-en/downloads Tested on: Ubuntu, LAAMP Vendor: Projeqtor Version: v9.3.1 Exploit Description...
verkehrspsychologen-oberfranken.de Cross Site Scripting vulnerability OBB-2319973
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
webapp.dimensionsystems.com Cross Site Scripting vulnerability OBB-2318594
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat
Description The application does not escape special characters, and the $msgPArent or $Result'additionalpostmessage' variables can lead to reflected XSS Proof of Concept https://demo.livehelperchat.com/chat/chatwidgetchat/444/123/theme/1/cstarted/123";;alert'xss';" Impact XSS can have huge...
Garrett Metal Detectors Path Traversal Vulnerability
Garrett Metal Detectors is a walk-in metal detector from Garrett U.S.A. Garrett Metal Detectors is vulnerable to a path traversal vulnerability that could be exploited by remote attackers to submit special requests and execute arbitrary commands in the application context...
Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat
Description The htmlspecialchars function does not escape special characters like single quote, and the $prefix parameter can lead to reflected XSS Proof of Concept https://demo.livehelperchat.com/siteadmin/user/avatarbuilder/1?=1640314779051&prefix=123%27;;%20alert%27xss%27;// Impact XSS can hav...
Design/Logic Flaw
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. Upon destruction of the object that owns it, the...
CVE-2021-40418
CVE-2021-40418 affects Blackmagic Design DaVinci Resolve’s R3D DPDecoder service and the R3D SDK. The issue arises when DPDecoder parses a file: it can skip assigning a property that should reference an UUID object parsed from a frame, leaving that member uninitialized. Upon destruction, the unin...
Blackmagic Design DaVinci Resolve Buffer Overflow Vulnerability
Blackmagic Design DaVinci Resolve is an all-in-one software tool for editing, color correction, visual effects, motion graphics and audio post-production.Blackmagic Design DaVinci Resolve 17.3.1.0005 is vulnerable to a buffer overflow vulnerability that could be exploited by attackers to execute...
How to Get Started With Application Security
With a comprehensive security stack, Akamai’s application security solutions defend your entire ecosystem from threats. But before you can reap the benefits that come with application security, you need to create a configuration with Akamai’s APIs. Our Developer Advocacy team is here to walk you...
CVE-2021-23803
This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters x00-x08 after the function will bypass these restriction...
CVE-2021-23803
Removed by vendor...
Adobe Experience Manager Cross-Site Scripting Vulnerability
Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...
CVE-2021-44315
In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server...
What is Clickjacking ❓ Definition and Prevention techniques
Progressed aggressors are persistently cultivating their systems to avoid region. Eventually, they can cover a clearly harmless site page with an immaterial layer containing noxious affiliations. This strategy for assault, known as clickjacking, could make you instigate your webcam or move cash...
CVE-2021-44655
Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to get admin access on the application...
