GHSA-3F2C-JM6V-CR35 Django DNS Rebinding Vulnerability

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWEDHOSTS...

GHSA-H2FP-XGX6-XH6F Pallets Werkzeug cross-site scripting vulnerability

Cross-site scripting XSS vulnerability in the renderfull function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 as used in Pallets Flask and other products allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message...

backstage-oauth2 (>=0.1.7, <=0.1.8), dbaas-aclapi (>=0.1.17, <=1.0.14) +4 more potentially affected by CVE-2015-2317 via django (>=1.5.12, <=1.6.10)

django PYPI version =1.5.12, =0.1.7, =0.1.17, =0.10.0, =0.10.2 - django-pesapal 0.2.0 - salmon 0.2.0 Source cves: CVE-2015-2317 Source advisory: GHSA-7FQ8-4PV5-5W5C...

GHSA-PVR5-84GR-G985 phpMyAdmin Implementation XSS Vulnerability on Server Monitor Page

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name, related to the...

phpMyAdmin Implementation XSS Vulnerability on Server Monitor Page

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name, related to the...

GHSA-VWHV-J36G-5RM8 Cross-site Scripting in Apache Struts

When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script. It is generally not advisable to have debug mode switched on...

Cross-site Scripting in Apache Struts

When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script. It is generally not advisable to have debug mode switched on...

GHSA-PWJQ-6WRH-5W8Q Withdrawn Advisory: OnionShare Predictable Pathname

Withdrawn Advisory This advisory has been withdrawn because the advisory concerns the repository https://github.com/onionshare/onionshare, which is not in a supported ecosystem. onionshare-cli is not affected by this issue. Original Description The debugmode function in web/web.py in OnionShare...

ovirt-engine Logs Plaintext Passwords To File

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

GHSA-M833-87VF-576C ovirt-engine Logs Plaintext Passwords To File

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

GHSA-RP89-32RP-QPQ2 Pagekit Weak Password Recovery Mechanism for Forgotten Password

An issue was discovered in Pagekit CMS before 1.0.11. In this vulnerability the remote attacker is able to reset the registered user's password, when the debug toolbar is enabled. The password is successfully recovered using this exploit. The SecureLayer7 ID is SL7PGKT01...

GHSA-WQ4C-WM6X-JW44 Withdrawn Advisory: Node.js Inspector RCE via DNS Rebinding

Withdrawn Advisory This advisory has been withdrawn because this vulnerability affects inspector code in https://github.com/nodejs/node, not the legacy debugger at https://github.com/node-inspector/node-inspector. https://github.com/nodejs/node is not in a supported ecosystem. Original Descriptio...

GHSA-6456-XJM5-G3PG Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in...

Cross-site scripting vulnerability exists in Jenkins and Stapler Plugin

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in...

CVE-2021-33080

Exposure of sensitive system information due to uncleared debug information in firmware for some IntelR SSD DC, IntelR OptaneTM SSD and IntelR OptaneTM SSD DC Products may allow an unauthenticated user to potentially enable information disclosure or escalation of privilege via physical access...

CVE-2022-0004

Hardware debug modes and processor INIT setting that allow override of locks for some IntelR Processors in IntelR Boot Guard and IntelR TXT may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

Design/Logic Flaw

Hardware debug modes and processor INIT setting that allow override of locks for some IntelR Processors in IntelR Boot Guard and IntelR TXT may allow an unauthenticated user to potentially enable escalation of privilege via physical access...

CVE-2022-0004

CVE-2022-0004 concerns Intel® Boot Guard and Intel® TXT. The issue arises from hardware debug modes and a processor INIT setting that allow an unauthenticated user to potentially bypass protections and escalate privileges via physical access. Intel lists affected generations (10th–12th Gen Core, ...

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk...

Powershell Exec, Generic x86 Debug Trap

Execute an x86 payload from a command via PowerShell. Generate a debug trap in the target process Module Options msf use payload/cmd/windows/powershell/generic/debugtrap msf payloaddebugtrap show actions ...actions... msf payloaddebugtrap set ACTION msf payloaddebugtrap show options ...show and s...