CVE-2022-29004

Diary Management System v1.0 is affected by a Cross-Site Scripting (XSS) vulnerability exploitable via the Name parameter in search-result.php. The Nuclei template (CVE-2022-29004) confirms the issue and describes impact as injection of malicious scripts leading to user-facing script execution, s...

PT-2022-19358 · Unknown · Library Management System

Name of the Vulnerable Software and Affected Versions: Diary Management System version 1.0 Description: The Diary Management System contains a cross-site scripting XSS issue via the Name parameter in the "search-result.php" endpoint. This allows for potential malicious script injection...

Diary Management System 跨站脚本漏洞

Diary Management System is a multi-user diary management system that enables staff in an organization to set/update/view meetings and appointments. The system will run through a central server, but clients will be able to run offline. A cross-site scripting vulnerability exists in Diary Managemen...

CVE-2022-29004: Improper Neutralization of Input During Web Page Generation

Diary Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Name parameter in search-result.php...

diary-gin.ru Cross Site Scripting vulnerability OBB-2535685

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Wordpress Plugin SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in the Wordpress Plugin...

WordPress Diary & Availability Calendar plugin <= 1.0.3 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Shreya Pohekar in WordPress Diary & Availability Calendar plugin versions = 1.0.3. Solution This plugin has been closed as of May 19, 2021 and is not available for download. Reason: Security Issue...

Reservation System Fixes Easy-to-Exploit XSS Bug

An easy-to-exploit bug impacting the WordPress plugin ReDi Restaurant Reservation allows unauthenticated attackers to pilfer reservation data and customer personal identifiable information by simply submitting a malicious snippet of JavaScript code into the reservation comment field. The bug...

WordPress ReDi Restaurant Reservation 21.0307 Cross Site Scripting

Exploit Title: WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting XSS Date: 2021-05-10 Exploit Author: Bastijn Ouwendijk Vendor Homepage: https://reservationdiary.eu/ Software Link: https://wordpress.org/plugins/redi-restaurant-reservation/ Version: 21.03...

[SECURITY] Fedora 34 Update: almanah-0.12.3-1.fc34

Almanah Diary is a small application to ease the management of an encrypted personal diary. It's got good editing abilities, including text formatting and printing. Evolution tasks and appointments will be listed to ease the creation of diary entries related to them. At the same time, you can...

Fedora: Security Advisory for almanah (FEDORA-2021-303f6623fa)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

h1-ctf: 12 Days of CTF Walkthroughs

h1-ctf: 12 Days of Hacky Holidays This is my writeup for 12 Days of Hacky Holidays. The report is written such that beginners to CTFs will be able to learn the tricks of the trade. The Mission: The Grinch has gone hi-tech this year with the intention of ruining the holidays 😱We need you to...

h1-ctf: Grinch Networks compromised!

Grinch Networks compromised! For fast triage/validation and inspired by @manoelt in other CTF, I made a bash script to find and print all the 12 flags of this CTF. The script uses curl, wget, google-chrome headless for flag 2, unzip, grep and sed. If any of these commands is missing, the script...

h1-ctf: h1 hacky holidays CTF solution

Simple script to print all the flags. Full solution to follow want to spend more time writing this, but am racing to be first 10 submissions: echo "Flag 1 -- robots.txt" curl https://hackyholidays.h1ctf.com/robots.txt 2/dev/null | grep flag echo "" echo "Flag 2 -- js descrambed --...

RHEL 8 : httpd:2.4 (RHSA-2020:3714)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3714 advisory. The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fixes: httpd: Push diary crash on...

FreeBSD : Apache httpd -- Multiple vulnerabilities (76700d2f-d959-11ea-b53c-d4c9ef517024)

The Apache httpd projec reports : - modhttp2: Important: Push Diary Crash on Specifically Crafted HTTP/2 Header CVE-2020-9490 A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards. -...

Apache httpd -- Multiple vulnerabilities

The Apache httpd projec reports: modhttp2: Important: Push Diary Crash on Specifically Crafted HTTP/2 Header CVE-2020-9490 A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the server actually tries to HTTP/2 PUSH a resource afterwards...

Pink Diary App has information leakage vulnerability

Powder Diary App is a life multi-functional recording tool App. Pink Diary APP has information leakage vulnerability, attackers can obtain sensitive information by searching keywords...

CVE-2017-15582

In net.MCrypt in the "Diary with lock" aka WriteDiary application 4.72 for Android, hardcoded SecretKey and iv variables are used for the AES parameters, which makes it easier for attackers to obtain the cleartext of stored diary entries...

CVE-2017-15581

In the "Diary with lock" aka WriteDiary application 4.72 for Android, neither HTTPS nor other encryption is used for transmitting data, despite the documentation that the product is intended for "a personal journal of ... secrets and feelings," which allows remote attackers to obtain sensitive...