5945 matches found
WordPress plugin Log HTTP Requests 跨站脚本漏洞
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Log HTTP Requests plugin 1.3.1 and earlier versions, which can be exploited by an attacke...
PT-2022-21970 · WordPress · Log Http Requests
Name of the Vulnerable Software and Affected Versions: Log HTTP Requests plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is related to Stored Cross-Site Scripting via logged HTTP requests due to insufficient input sanitization and output escaping. This allows...
WordPress Log HTTP Requests plugin <= 1.3.1 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Etan Imanol Castro Aldrete in WordPress Log HTTP Requests plugin versions = 1.3.1. Solution Update the WordPress Log HTTP Requests plugin to the latest available version at least 1.3.2...
CVE-2022-40876
The CVE-2022-40876 entry concerns Tenda AX1803 v1.0.0.1, where HTTP requests processed by the fromAdvSetMacMtuWan functions, specifically involving wanSpeed, cloneType, and mac, can trigger a stack overflow and enable remote code execution (RCE). Public references (NVD, Red Hat, CVE listings) cor...
PT-2022-25600 · Tenda · Tenda Ax1803
Name of the Vulnerable Software and Affected Versions: Tenda ax1803 version 1.0.0.1 Description: The issue concerns http requests handled by the fromAdvSetMacMtuWan functions, specifically the wanSpeed, cloneType, and mac variables, which can cause a stack overflow and enable remote code executio...
Information Disclosure
reactor-netty is vulnerable to information disclosure. A remote attacker is able to request log headers in some cases of invalid HTTP requests which may reveal valid access tokens when WARN level is enabled, resulting in disclosure of sensitive information...
The vulnerability in the web interface of the Moxa MXView software control device allows a hacker to gain full access to the device.
The vulnerability of the Moxa MXView network control software web interface is related to the use of strictly encrypted login credentials. Exploiting this vulnerability allows a malicious actor to gain full access to the device by sending a specially crafted HTTP request...
Abode Iota 操作系统命令注入漏洞
Abode Iota is a reliable Diy home security system from Abode. An operating system command injection vulnerability exists in Abode Iota versions 6.9X and 6.9Z, which stems from an os command injection in the web interface utilsetabodecode function and can be exploited by an attacker to execute...
Abode Systems, Inc. iota All-In-One Security Kit web interface /action/ipcamRecordPost OS command injection vulnerability
Talos Vulnerability Report TALOS-2022-1563 Abode Systems, Inc. iota All-In-One Security Kit web interface /action/ipcamRecordPost OS command injection vulnerability October 20, 2022 CVE Number CVE-2022-32586 SUMMARY An OS command injection vulnerability exists in the web interface...
CVE-2022-31684
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...
CVE-2022-31684
Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled...
CVE-2022-31684
CVE-2022-31684 affects Tanzu VMware Reactor Netty (HTTP Server) versions 1.0.11–1.0.23. The issue is that request headers may be logged in certain invalid HTTP requests when WARN logging is enabled, potentially exposing valid access tokens found in those logs. The connected Red Hat and IBM adviso...
CVE-2022-40684
An authentication bypass using an alternate path or channel CWE-288 in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform...
The vulnerability of the Pallets Werkzeug web application library, related to deficiencies in HTTP request processing, allows attackers to execute XSS attacks.
The vulnerability of the Pallets Werkzeug web application lies in its lack of proper HTTP request processing. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using specially crafted HTTP requests...
CVE-2022-2428
A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...
UBUNTU-CVE-2022-2428
A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...
CVE-2022-2428
CVE-2022-2428 affects GitLab EE/CE where a crafted tag in the Jupyter Notebook viewer enables an attacker to issue arbitrary HTTP requests. The issue affects all GitLab releases before 15.1.6, and across 15.2 (15.2.0–15.2.4) and 15.3 (15.3.0–15.3.2). Notably, the vulnerability is tied to the Jupy...
CVE-2022-2428
A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests...
