CVE-2021-30214: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter...

PT-2021-18668

Name of the Vulnerable Software and Affected Versions Knowage Suite version 7.3 Description The issue concerns Stored Client-Side Template Injection. It affects the '/knowage/restful-services/signup/update' endpoint via the name parameter. Recommendations For Knowage Suite version 7.3, consider...

StackLift LocalStack Cross-Site Scripting Vulnerability

StackLift LocalStack is a StackLift open source application. Provides an easy-to-use testing framework for cloud applications. A cross-site scripting vulnerability exists in StackLift LocalStack version 0.12.6, which stems from a lack of proper validation of client-side data by the WEB applicatio...

Jetbrains TeamCity cross-site scripting vulnerabilities

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A cross-site scripting vulnerability exists in...

PT-2021-3053 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a lack of protection for service data in the Windows CSC service, which can be exploited to gain unauthorized access to protected information. This can allow attacke...

PT-2021-19783

Name of the Vulnerable Software and Affected Versions OctoPrint versions prior to 1.6.0 Description The issue allows for XSS because API error messages include the values of input parameters, such as username or other user-provided data. This can lead to malicious scripts being executed on the...

GHSA-R2GR-FHMR-66C5 Duplicate Advisory: "Arbitrary code execution in socket.io-file"

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6495-8jvh-f28x. This link is maintained to preserve external references. Original Description "The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows...

Duplicate Advisory: "Arbitrary code execution in socket.io-file"

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6495-8jvh-f28x. This link is maintained to preserve external references. Original Description "The socket.io-file package through 2.0.31 for Node.js relies on client-side validation of file types, which allows...

StackLift LocalStack Cross-site Scripting Vulnerability

StackLift LocalStack is a StackLift open source application. Provides an easy-to-use testing framework for cloud applications. A cross-site scripting vulnerability exists in StackLift LocalStack version 0.12.6, which stems from a lack of proper validation of client-side data by the WEB applicatio...

Client-Side Prototype Pollution

Prototype-based programming languages rely on the process of defining objects used as prototypes to be then extended or cloned in order to create new objects. Once instantiated, these objects will inherit from the properties and methods of their prototype. JavaScript is one of the most common...

Wordpress WP Super Edit 2.5.4 Plugin - Remote File Upload Vulnerability

Title: Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload Author: h4shur Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/plugins/wp-super-edit/ Version : 2.5.4 and earlier Tested on: Windows 10 & Google Chrome Category : Web Application Bugs Dork :...

Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload

Title: Wordpress Plugin WP Super Edit 2.5.4 - Remote File Upload Author: h4shur date: 2021-05-06 Vendor Homepage: https://wordpress.org Software Link: https://wordpress.org/plugins/wp-super-edit/ Version : 2.5.4 and earlier Tested on: Windows 10 & Google Chrome Category : Web Application Bugs Dor...

U.S. Dept Of Defense: [www.███] Reflected Cross-Site Scripting

Description: Good morning, there's a reflected cross-site scripting vulnerability on https://www.██████████/█████ There was some difficult in making a payload for this vulnerability, mainly due to the WAF blocking some vectors; But exploitation is still possible. Here's a proof of concept showing...

PT-2021-18106

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions prior to 6.9.5 Aruba ClearPass Policy Manager versions prior to 6.8.9 Aruba ClearPass Policy Manager versions prior to 6.7.14-HF1 Description: A remote cross-site scripting XSS vulnerability was...

PT-2021-16813

Name of the Vulnerable Software and Affected Versions MintHCM version 3.0.8 Description The issue concerns the Import function, which allows an attacker to execute a cross-site scripting XSS payload through file-upload. This could potentially lead to malicious script execution on the client-side...

CVE-2021-0269

The improper handling of client-side parameters in J-Web of Juniper Networks Junos OS allows an attacker to perform a number of different malicious actions against a target device when a user is authenticated to J-Web. An attacker may be able to supersede existing parameters, including hardcoded...

Hardcoded credentials

The improper handling of client-side parameters in J-Web of Juniper Networks Junos OS allows an attacker to perform a number of different malicious actions against a target device when a user is authenticated to J-Web. An attacker may be able to supersede existing parameters, including hardcoded...

CVE-2021-0269

The CVE-2021-0269 entry concerns Juniper Networks Junos OS J-Web. The root cause is improper handling of client-side parameters, allowing an authenticated attacker to supersede or modify HTTP/S session parameters, bypass input validation rules, and alter J-Web behavior. Potential consequences inc...

120 Compromised Ad Servers Target Millions of Internet Users

An ongoing malvertising campaign tracked as "Tag Barnakle" has been behind the breach of more than 120 ad servers over the past year to sneakily inject code in an attempt to serve malicious advertisements that redirect users to rogue websites, thus exposing victims to scamware or malware. Unlike...

Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2 allows attacker to update element property values via crafted synchronization message. - https://vaadin.com/security/cve-2018-25007...