CVE-2021-29480

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used which is recommended, but is n...

Ratpack 安全特征问题漏洞

Ratpack is a Java library for building scalable HTTP applications. A security vulnerability exists in Ratpack versions prior to 1.9.0, which stems from the client-side session module defaulting to using the application startup time as the signing key, and can be exploited by an attacker to tamper...

ECShop 跨站脚本漏洞

ECShop is an open source mall system for business school . Support PC + H5 + APP + small program mall, source code free download experience, suitable for enterprise development and build mall. There is a cross-site scripting vulnerability in ECShop, which originates from the lack of security...

Acronis: CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud

Summary Hi team, I hope everything goes well. I have found a CSS Injection in Acronis Cloud Management Consolehttps://mc-beta-cloud.acronis.com/mc via the colorscheme GET parameter. Description: The flow work as I will comment below. If we go to the URL...

Shopware 跨站脚本漏洞

Shopware is an open source e-commerce platform. A cross-site scripting vulnerability exists in Shopware versions prior to 5.6.10. An attacker can exploit this vulnerability to inject malicious script into Administration to execute client-side code...

SUSE Manager和SUSE Linux Enterprise Server 授权问题漏洞

SUSE Manager and SUSE Linux Enterprise Server are both products of SUSE, Germany.SUSE Manager is a Linux server management system. SUSE Manager is a Linux server management system that provides automated software management, system configuration, and monitoring.SUSE Linux Enterprise Server is an...

McAfee TechCheck Client-side Loading Code Execution

The vulnerability of the PC performance scanning system’s McAfee TechCheck lies in the loading of a non-existent dynamic library. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Cross site scripting

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

CVE-2010-4264

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

CVE-2010-4264: Improper Neutralization of Input During Web Page Generation

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

Design/Logic Flaw

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user even unauthenticated to add unlimited like/dislike to any comment. The plugin appears to have som...

CVE-2021-24379 Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user even unauthenticated to add unlimited like/dislike to any comment. The plugin appears to have som...

Trace Financial CRESTBridge Cross-Site Scripting Vulnerability (CNVD-2021-61763)

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial CRESTBridge, which can be exploited by attackers to execute client-side code...

Trace Financial Crest Bridge Cross-Site Scripting Vulnerability

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial Crest Bridge, which can be exploited by attackers to execute client-side code...

Google Workspace Now Offers Client-side Encryption For Drive and Docs

Google on Monday announced that it's rolling out client-side encryption to Google Workspace formerly G Suite, thereby giving its enterprise customers direct control of encryption keys and the identity service they choose to access those keys. "With client-side encryption, customer data is...

Backdoor.Win32.Zombam.gen Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ff6516c881dee555b0cd253408b64404.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.gen Vulnerability: Cross Site Scripting XSS Description: Zombam malware listen...

Trace Financial CRESTBridge 跨站脚本漏洞

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial CRESTBridge, which can be exploited by attackers to execute client-side code...

Trace Financial Crest Bridge 跨站脚本漏洞

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial Crest Bridge, which can be exploited by attackers to execute client-side code...

GitLab Cross-Site Scripting Vulnerability (CNVD-2021-40769)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab tha...

Parvan Dobrev scimono 注入漏洞

Parvan Dobrev scimono is Parvan Dobrev an open source application . A server-side and a client-side are provided. Parvan Dobrev scimono suffers from an injection vulnerability, which stems from incorrect innocuous handling of input, where an unauthenticated attacker could inject specially designe...