WordPress plugin SQL注入漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A SQL injection vulnerability exists in previous versions of the Wordpress Plugin Cookie Notification Plugin 1.0.9, which stems from the product's failure to validate special characters in the id...

CVE-2022-22551

DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...

CVE-2022-22551

DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...

CVE-2021-33966

Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...

CVE-2021-33966

Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...

Cross site scripting

Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...

CVE-2021-33966

Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...

CVE-2021-33966

Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...

CVE-2021-33966

Cross site scripting XSS vulnerability in spotweb 1.4.9, allows authenticated attackers to execute arbitrary code via crafted GET request to the login page...

CVE-2021-33966

Removed by vendor...

CVE-2022-22551: Use of GET Request Method With Sensitive Query Strings

DELL EMC AppSync versions 3.9 to 4.3 use GET request method with sensitive query strings. An Adjacent, unauthenticated attacker could potentially exploit this vulnerability, and hijack the victim session...

PT-2022-15519

Name of the Vulnerable Software and Affected Versions DELL EMC AppSync versions 3.9 to 4.3 Description The issue concerns the use of GET request methods with sensitive query strings, potentially allowing an adjacent, unauthenticated attacker to exploit this and hijack the victim's session...

DELL EMC AppSync 授权问题漏洞

DELL EMC AppSync is a replication data management software from Dell USA Inc. A security vulnerability exists in DELL EMC AppSync due to the use of the GET request method with sensitive query strings in DELL EMC AppSync versions 3.9 through 4.3. . An attacker could use this vulnerability to hijac...

Vodafone H-500-s 3.5.10 - WiFi Password Disclosure Exploit

Exploit Title: Vodafone H-500-s 3.5.10 - WiFi Password Disclosure Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://www.vodafone.es/ Software Link: N/A Version: Firmware version Vodafone-H-500-s-v3.5.10 Hardware model: Sercomm VFH500 The WiFi access point password gets disclosed jus...

Vodafone H-500-s 3.5.10 WiFi Password Disclosure

Exploit Title: Vodafone H-500-s 3.5.10 - WiFi Password Disclosure Date: 01/01/2022 Exploit Author: Daniel Monzón stark0de Vendor Homepage: https://www.vodafone.es/ Software Link: N/A Version: Firmware version Vodafone-H-500-s-v3.5.10 Hardware model: Sercomm VFH500 The WiFi access point password...

Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat

Description I found one more CSRF at Clean cache in the System tab of System configuration via GET request. Proof of Concept CLICK ME! Impact This vulnerability is capable of tricking admin to clear the cache of the system, that can potential lead to a DoS attack. Remediation Use POST request...

CVE-2021-41024

A relative path traversal CWE-23 vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page...

Path traversal

A relative path traversal CWE-23 vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page...

CVE-2021-41024

A relative path traversal CWE-23 vulnerabiltiy in FortiOS versions 7.0.0 and 7.0.1 and FortiProxy verison 7.0.0 may allow an unauthenticated, unauthorized attacker to inject path traversal character sequences to disclose sensitive information of the server via the GET request of the login page...

Server side request forgery (ssrf)

An information disclosure via GET request server-side request forgery vulnerability was discovered with the Workplace Search Github Enterprise Server integration. Using this vulnerability, a malicious Workplace Search admin could use the GHES integration to view hosts that might not be publicly...