6064 matches found
WordPress The Any Hostname plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Any Hostname plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in WordPres...
Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin
✍️ Description Attacker able to delete any admin with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks i...
Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin
✍️ Description Attacker able to delete any local picture with CSRF attack. It does not matter at all that phproject run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of filebrowser application. It does...
Cross-Site Request Forgery (CSRF) in zhongshaofa/easyadmin
✍️ Description Attacker able to change any password and username with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. I...
Cross-Site Request Forgery (CSRF) in alanaktion/phproject
✍️ Description Attacker able to delete any group with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks i...
CVE-2021-24481
The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it...
CVE-2021-24481
The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it...
Cross site scripting
The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its "Allowed hosts" setting, leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it...
CVE-2021-24481
The CVE-2021-24481 entry describes an authenticated stored XSS in the WordPress Any Hostname plugin (version up to 1.0.6) due to failure to sanitize/escape the Allowed hosts setting. Attackers with high privileges can inject XSS payloads via that setting, as documented by multiple sources (e.g., ...
WordPress 插件跨站脚本漏洞
WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Any Hostname plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in WordPres...
URIjs Vulnerable to Hostname spoofing via backslashes in URL
Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash \ and slash / characters as part of the scheme delimiter, e.g. scheme:///\hostname. If the hostname is used in security decisions, the decision may be incorrect...
GHSA-89GV-H8WF-CG8R URIjs Vulnerable to Hostname spoofing via backslashes in URL
Impact If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash \ and slash / characters as part of the scheme delimiter, e.g. scheme:///\hostname. If the hostname is used in security decisions, the decision may be incorrect...
Kali-Whoami - A Privacy Tool Developed To Keep You Anonymous On Kali Linux At The Highest Level
The purpose of the Whoami tool makes you as anonymous as possible on Kali linux. It is an user friendly with its ease of use and simple interface. It follows two different paths to ensure the highest possible level of anonymity. Finally, don't forget that there is never a hundred percent security...
Fossil has an unspecified vulnerability
Fossil is a simple, highly reliable distributed software configuration management system. A security vulnerability exists in Fossil that stems from a hostname check that is commonly skipped during certificate validation. This issue affects: versions prior to 2.15, versions prior to 2.14. No detai...
Insecure Validation
Fossil has insecure validation. The vulnerability exists due to the system skipping the hostname check during TLS certificate validation...
CVE-2021-36377
Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...
DEBIAN-CVE-2021-36377
Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...
CVE-2021-36377
Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation...
