12871 matches found
CVE-2022-22571
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions...
Cross site scripting
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions...
CVE-2022-22571
CVE-2022-22571 affects Incapptic Connect. The vulnerability arises from incorrect output encoding, enabling a stored XSS when exploited by an authenticated high-privileged user. Affected scope is described as all current versions; exploitation requires authentication and elevated privileges, with...
CVE-2022-22571
An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions...
Cross-site Scripting (XSS) - Stored
Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Then, the vulnerability can be triggered when the user previews the document´s content. Proof ...
CVE-2022-24836
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri = 1.13.4. There are no known workarounds for this issue...
Nokogiri 安全漏洞
Nokogiri is an open source software library for parsing HTML and XML in Ruby. A security vulnerability exists in versions prior to Nokogiri 1.13.4 that stems from its susceptibility to excessive backtracking when attempting to detect encoding in HTML documents...
UPS VDP: Reflected XSS on https://wwwapps.ups.com/ctc/request?loc=
Summary: ========= Detalis XSS ----------- Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a...
PT-2022-5409 · Owasp · Owasp Antisamy
Name of the Vulnerable Software and Affected Versions: OWASP AntiSamy versions prior to 1.6.7 Description: The issue is related to the incorrect encoding of Cascading Style Sheets CSS content, allowing for HTML tag smuggling on STYLE content with crafted input. This can lead to cross-site scripti...
PT-2022-4890
Name of the Vulnerable Software and Affected Versions Nokogiri versions prior to 1.13.4 Description The issue is related to an inefficient regular expression in the Nokogiri library, which can lead to excessive backtracking when detecting encoding in HTML documents. This can be exploited by a...
The vulnerability of the MongoDB database management system allows attackers to compromise data integrity.
The vulnerability of the MongoDB database management system lies in the lack of mechanisms for encoding or filtering output data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the data...
Online Banquet Booking System 1.0 Cross Site Request Forgery
Exploit Title: Online Banquet Booking System - 'change admin credentials' Cross-Site Request Forgery CSRF Date: 04/04/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://phpgurukul.com Software Link: https://phpgurukul.com/online-banquet-booking-system-using-php-and-mysql/ Version: 1.0...
The vulnerability of the decoder in the MPEG-4 multimedia platform GPAC’s encoding function allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.
The vulnerability of the decoder in the MPEG-4 multimedia platform GPAC’s decoding function is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to gain access to confidential data, compromise its integrity, and cause service failures...
CVE-2022-0901
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters...
Cross site scripting
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters...
The vulnerability of the XML DOM implementation lies in the lack of mechanisms for encoding or escaping output data, allowing attackers to compromise the integrity of the data.
The vulnerability of the XML DOM implementation is related to improper filtering of special characters. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...
Exploit for Code Injection in Vmware Spring_Framework
Spring Framework RCE exploitation Quick pentest notes...
Puma vulnerable to HTTP Request Smuggling
When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma. The following...
PT-2022-7650 · Puma +11 · Puma +11
Name of the Vulnerable Software and Affected Versions: Puma versions prior to 4.3.12 Puma versions prior to 5.6.4 Description: The issue is related to the handling of HTTP requests in Puma, a server for Ruby/Rack applications. When Puma is used behind a proxy that does not properly validate...
uDraw < 3.3.3 - Unauthenticated Arbitrary File Access
The plugin does not validate the url parameter in its udrawconverturltobase64 AJAX action available to both unauthenticated and authenticated users before using it in the filegetcontents function and returning its content base64 encoded in the response. As a result, unauthenticated users could re...