CVE-2021-29974

When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security which implies that the error should not be override-able. This issue did not...

UBUNTU-CVE-2021-29974

When network partitioning was enabled, e.g. as a result of Enhanced Tracking Protection settings, a TLS error page would allow the user to override an error on a domain which had specified HTTP Strict Transport Security which implies that the error should not be override-able. This issue did not...

[ASA-202107-20] firefox: multiple issues

Arch Linux Security Advisory ASA-202107-20 ========================================== Severity: High Date : 2021-07-14 CVE-ID : CVE-2021-29970 CVE-2021-29972 CVE-2021-29974 CVE-2021-29975 CVE-2021-29976 CVE-2021-29977 CVE-2021-30547 Package : firefox Type : multiple issues Remote : Yes Link :...

Apache HTTP Server Detection (HTTP Error Page)

HTTP error-page based detection of the Apache HTTP Server. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fortinet FortiGate 跨站脚本漏洞

Fortinet FortiGate is a network security platform from Fortinet, Inc. The platform provides firewall, anti-virus and intrusion prevention IPS, application control, anti-spam, wireless controller, and WAN acceleration capabilities.A cross-site scripting vulnerability exists in Fortinet FortiGate...

Sifchain: Error Page Content Spoofing or Text Injection

i want to report a context spoofing or text injection at api-cryptoeconomics.sifchain.finance and market-data.sifchain.finance steps to reproduce: 1: Just browse this target on any browser 2: Target: https://api-cryptoeconomics.sifchain.finance/ 3: Then add any text or content after the "/" , i...

Sifchain: Flaws In Social media Icon on error page which can lead to financial loss to a company.

Here, i found an issue on sifchain.finance that will direct impact to the customer of sifchain company which can be great loss in business as well as there will be problem regarding to communication with the genuine customer of a company. I know that sifchain.finance is not in scope but i saw thi...

Exploit for Cross-site Scripting in Apache Http_Server

This is a PoC exploit for CVE-2019-10092, a Limited Cross-Site Scripting in modproxy Error Page-Apache httpd vulnerability. The target product/service is Apache HTTP Server, and the vulnerability class/vector is XSS. The probable entry points are the start.sh script, which invokes the Apache serv...

Unauthenticated users can inject messages into the XSRF token error page

Affected versions of Atlassian Jira Server and Data Center allow unauthenticated remote attackers to display arbitrary messages in the application via an injection vulnerability in the XSRF token error page. The affected versions are before version 8.5.14, and from version 8.6.0 before 8.12.1. ...

CVE-2021-26030

An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page...

Cross site scripting

An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page...

PT-2021-16923 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.25 Description: An issue was discovered that allows XSS attacks due to inadequate escaping. This is possible using the logo parameter of the default templates on the error page. Recommendations: For Joomla!...

Open Source Matters Joomla 跨站脚本漏洞

Joomla! is a globally recognized content management system developed using the PHP language coupled with a MySQL database that can be implemented on various platforms such as Linux, Windows, MacOSX, and many others. A cross-site scripting vulnerability exists in Joomla! versions 3.0.0 through...

OESA-2021-1122 velocity-tools security update

The VelocityTools project is a collection of useful Java classes aka tools, as well as infrastructure to easily, automatically and transparently make these tools available to Velocity templates. Project include easy integration of Velocity into the view-layer of web applications via the...

GHSA-FH63-4R66-JC7V Cross-site scripting (XSS) in Apache Velocity Tools

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to...

Cross-site Scripting (XSS)

velocity-tools-view is vulnerable cross-site scripting XSS. An attacker is able to inject and execute malicious script in a user's browser as it does not escape a user-provided vm file as part of the URL which displayed in the error page...

CVE-2020-13959

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to...

DEBIAN-CVE-2020-13959

The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to...

PT-2021-9683

Name of the Vulnerable Software and Affected Versions Apache Velocity Tools versions prior to 3.1 Description The default error page for VelocityView in Apache Velocity Tools reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in...

CVE-2017-5664

A vulnerability was discovered in the error page mechanism in Tomcat's DefaultServlet implementation. A crafted HTTP request could cause undesired side effects, possibly including the removal or replacement of the custom error page. Mitigation If it is necessary to have the DefaultServlet propert...