1126636 matches found
CVE-2024-29399
CVE-2024-29399 脆弱性の詳細 概要 Savane v3.13 以前では、アップロードされたファイルの検証が欠如しているため、権限昇格が可能になる可能性があります。インストール手順に従って設定された Web サーバーは、クロスサイトスクリプティング XSS に対して脆弱です。誤って設定された Web サーバーでは、これによりリモートコード実行 RCE が発生する可能性があります。 CWE 分類: CWE-434: 危険なタイプのファイルのアップロード制限の欠如 報告者: Ally Petitt 影響を受ける製品 : Savane 影響を受けるバージョン : 3.13 以前...
CVE-2022-29455
CVE-2022-29455 Wordpressの脆弱性 - XSS（クロスサイトスクリプティング） 脆弱性の位置 https://add your target here/wp-content/plugins/elementor/assets/js/frontend.min.js 脆弱性のあるバージョン 例 - https://www.youtube.com/watch?v=4qvOkSbhcE...
CVE-2026-39038
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting XSS in the component Trufflebox UI trufflebox-ui in GenericNumerixTable.jsx...
CVE-2022-28077
CVE-2022-28077 Home Owners Collection Management System 1.0 - 反射型XSS 漏洞利用标题：Home Owners Collection Management System 1.0 - 反射型XSS 日期：2022-05-06 CVE：CVE-2022-28077 漏洞利用作者：Abdulaziz Saad @b4zb0z 厂商主页：https://www.sourcecodester.com/...
CVE-2019-10092_Docker
CVE-2019-10092 Docker - Apache HTTP 服务器 使用 root@kitploit: $ docker-compose up 从 Docker Hub 使用 root@kitploit: $ docker run -p 5555:5555 motikan2010/cve-2019-10092 PoC 披露/CVE-2019-10092-modproxy 错误页面中的受限跨站脚本 - Apache httpd，位于 DrunkenShells/Disclosures 的 master 分支...
CVE-2015-9251
CVE-2015-9251 [email protected] 针对 jQuery 低于 3.0.0 版本的 CVE-2015-9251 概念验证（PoC）。 CVE-2015-9251 - PoC 漏洞利用 此仓库包含 CVE-2015-9251 漏洞在 jQuery 库中的 概念验证 PoC 。该漏洞允许通过未经过滤的 JSONP 调用实施跨站脚本（XSS）攻击，原因在于 jQuery 在 3.0.0 之前版本中允许在 callback 参数中注入代码。 描述 CVE-2015-9251 影响 jQuery 3.0.0 之前版本。该漏洞通过操控 JSONP 请求中的...
CVE-2019-10092
CVE-2019-10092：Apache HTTP Server "Proxy Error" 页面中的有限跨站脚本攻击 在 Apache HTTP Server 2.4.0-2.4.39 版本中，报告了一个影响 modproxy 错误页面的有限跨站脚本问题。攻击者可能导致错误页面上的链接格式错误，进而指向他们选择的页面。只有在服务器启用了代理功能但配置不当导致显示代理错误页面时，才可能利用此漏洞。 厂商披露： 厂商的披露及对此漏洞的修复可在此处找到：这里。 利用条件： 此漏洞需要： 能够访问 "Proxy Error" 页面的途径 用户交互 概念验证： 更多细节和利用过程可在此 PDF...
EUVD-2026-78826
A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such manipulation of the argument desc leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used...
Joplin-CVE-2022-35131
Joplin CVE-2022-35131 XSS 导致 RCE，影响 Joplin 版本 2.8.8 及更早版本。已在 Windows 和 Linux 上测试并生效。 报告并修复于：2022-06 技术概述 1. 创建一条标题包含 JavaScript 有效载荷（payload）的笔记（示例载荷见下文） 2. 按下 Ctrl+P 并在笔记或标题中搜索内容 3. 有效载荷在搜索结果中显示时被执行 4. 通过共享笔记本可实现远程代码执行 问题在于 GotoAnything.tsx 第 509 行使用 dangerouslySetInnerHTML...
CVE-2019-15053
CVE-2019-15053 FAB-2019-00156 由我发现的漏洞 CVE-2019-15053 公告：advisory.txt 基本信息 root@kitploit: Advisory ID..........: FAB-2019-00156 Product..............: HTML Include and replace macro Manufacturer.........: The Plugin People Affected Versions..: 1.4.2 and before Tested Versions....: 1.4.2...
CVE-2024-4367-PDF.js-xss
CVE-2024-4367–PDF.js-xss CVE-2024-4367–PDF.js-xss 下载环境，解压，进入 root@kitploit: unzip cve-2024-4367-lab cd cve-2024-4367-lab 环境启动命令 root@kitploit: mkdir upload chmod 777 upload docker-compose up -d...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting
A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...
golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...
Important: Red Hat Security Advisory: grafana security update
An update for grafana is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.38 packages and security update
Red Hat OpenShift Container Platform release 4.20.38 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.14 packages and security update
Red Hat OpenShift Container Platform release 4.22.14 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a...