The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, arises due to the failure to take measures to eliminate special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the United States of America Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management...

golang: html/template: improper handling of HTML-like comments within script contexts

A flaw was found in Golang. The html/template package did not properly handle HMTL-like "" comment tokens, nor hashbang "!" comment tokens, in contexts. This issue may cause the template parser to improperly interpret the contents of contexts, causing actions to be improperly escaped...

Umbraco Cross-Site Scripting Vulnerability

Umbraco is an open source Content Management System CMS written in C by the Danish company Umbraco. Umbraco suffers from a cross-site scripting vulnerability that originates from a user with access to specific parts of the backend being able to inject HTML code into unwanted forms...

The vulnerability in the Web Browser UI interface of Google Chrome and Microsoft Edge allows attackers to perform spoofing attacks.

The vulnerability of the Web Browser UI interface in Google Chrome and Microsoft Edge is related to improperly implemented security checks for standard elements. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks using a specially created HTML page...

CVE-2023-48122

An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method...

DoraCMS 安全漏洞

DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...

jetty: Improper validation of HTTP/1 content-length

A flaw was found in Jetty that permits a plus sign + preceding the content-length value in a HTTP/1 header field, which is non-standard and more permissive than RFC. This issue could allow an attacker to request smuggling in conjunction with a server that does not close connections after 400...

SUSE CVE-2023-6508

Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2023-9830 · Oracle · Oracle Financial Services Revenue Management/Billing

Name of the Vulnerable Software and Affected Versions: Oracle Financial Services Revenue Management and Billing versions 6.0.0.0.0 through 6.1.0.0.0 Description: The issue is related to insufficient input validation in the Chatbot component of Oracle Financial Services Revenue Management and...

Appointment Scheduler Security Vulnerability

PHPJabbers Appointment Scheduler is a Php-based appointment scheduler plugin for planning time and booking meeting schedules from PHPJabbers Serbia. A security vulnerability exists in Appointment Scheduler version 3.0, which stems from multiple HTML injection vulnerabilities in...

The vulnerability of the Mastodon web application for deploying distributed social networks, related to the unlimited distribution of resources, allows a hacker to cause a service failure.

The vulnerability of the Mastodon web application for deploying distributed social networks is related to the unlimited distribution of resources during HTTP request processing. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Microsoft Graphics Component Information Disclosure Vulnerability

Microsoft Graphics Component is a graphics driver component from Microsoft Corporation USA. An information disclosure vulnerability exists in Microsoft Graphics Component msgraph-sdk-php that originates from a vulnerability that allows an attacker to craft HTTP requests to be able to access syste...

HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

A flaw was found in handling multiplexed streams in the HTTP/2 protocol. A client can repeatedly make a request for a new multiplex stream and immediately send an RSTSTREAM frame to cancel it. This creates extra work for the server setting up and tearing down the streams while not hitting any...

The vulnerability of the PDF document viewing program Foxit PDF Reader (formerly Foxit Reader) lies in errors during the processing of hypertext links, allowing a hacker to execute arbitrary code.

The vulnerability of the PDF document viewing program Foxit PDF Reader formerly Foxit Reader is related to errors in processing hypertext links. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the PDF document viewing program Foxit PDF Reader (formerly Foxit Reader) lies in errors during the processing of hypertext links, allowing a hacker to execute arbitrary code.

The vulnerability of the PDF document viewing program Foxit PDF Reader formerly Foxit Reader is related to errors in processing hypertext links. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

JBoss Enterprise Application Platform Security Vulnerability

Red Hat JBoss Enterprise Application Platform JBoss Eap is a subscription-based/open source Java Ee-based application server runtime platform from Red Hat, Inc. It is used to build, deploy, and host highly transactional Java applications and services developed and maintained by Red Hat. A securit...

Vite Cross-Site Scripting Vulnerability

Vite is a new front-end builder tool open-sourced by Vite. Vite suffers from a cross-site scripting vulnerability that stems from the ability to inject arbitrary HTML into the output by providing a malicious URL query string...

DEBIAN-CVE-2023-49081

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request e.g. to insert a new header or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the...

PYSEC-2023-250

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request e.g. to insert a new header or create a new HTTP request if the attacker controls the HTTP version. The vulnerability only occurs if the...