CVE-2019-16925

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change th...

Design/Logic Flaw

DISPUTED Flower 0.9.3 has XSS via a crafted worker name. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them alread...

PT-2019-14872 · Celery · Flower

Name of the Vulnerable Software and Affected Versions: Flower version 0.9.3 Description: The issue concerns a potential XSS via the name parameter in an @app.task call. However, the project author disputes the validity of this issue, stating that worker and task names are internal backend...

CVE-2015-3646

OpenStack Identity Keystone before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backendargument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs...

XYCMS企业建站系统 2.5(注射&&后台配置插马)

简要描述： 前年她17岁，她看到我的IPad，说“姐夫，你的IPad不错嘛！” 她回去的时候，她姐姐把IPhone给她带上了。 去年她18岁，她看到我的IBM后，说“姐夫，你的IBM不错嘛！” 她回去的时候，她姐姐把IBM笔记本给她带上了。 今年她19岁，她看到我后，害羞的说：“姐夫，其实你这人挺不错的” 我在等她姐姐发话。 详细说明： 1 存在注入漏洞文件： newsdetail.asp 1-14行 无此新闻信息！" response.End end if % id没过滤进入查询 同样的问题：common.asp pro.asp news.asp prodetail.asp 漏洞证明：...

M Number of the article management system of 0day-vulnerability warning-the black bar safety net

!-- include file="include/head. asp" - 1 4.& lt;!-- include file="include/ubb2html. asp" - 1 5.& lt;% 1 6. Dim...