4986 matches found
CVE-2021-27201
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
Design/Logic Flaw
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
CVE-2021-27201
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
CVE-2021-27201: Improper Neutralization of Special Elements used in an OS Command
Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...
ExpressionEngine: Comment/channel unsubscribe GET CSRF
A vulnerability was identified and fixed that could have allowed attackers to unsubscribe users from comment notifications by exploiting the lack of CSRF protection...
Cross-site Scripting (XSS)
xwiki-commons is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary script via an SVG document to the upload feature of the comment section...
Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
GHSA-43HG-G44Q-474Q Cross Site Scripting (XSS) in XWiki
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
Design/Logic Flaw
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137
CVE-2021-3137 affects XWiki 12.10.2, enabling XSS via an SVG document uploaded to the comment feature. Root cause: insecure handling of SVG uploads leading to script injection. Impact: cross-site scripting in affected deployments. Mitigation: vendor fix (VendorFix) referenced by OpenVAS entries; ...
CVE-2021-3137
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
CVE-2021-3137: Improper Neutralization of Input During Web Page Generation
XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section...
Xwiki CMS 12.10.2 - Cross Site Scripting (XSS)
Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...
Xwiki CMS 12.10.2 Cross Site Scripting
Exploit Title: Xwiki CMS 12.10.2 - Cross Site Scripting XSS Date: 17-01-2021 Exploit Author: Karan Keswani Vendor Homepage: https://www.xwiki.org/xwiki/bin/view/Main/WebHome Software Link: https://www.xwiki.org/xwiki/bin/view/Download/ Version: Xwiki CMS- 12.10.2 Tested on: Windows 10 Description...
Server-Side Template Injection (SSTI)
pwntools is vulnerable to server-side template injection. An attacker is able to inject and execute arbitrary code via the Shellcraft generation due to insecure parsing of strings that containing end of multiline comment...