1488 matches found
Form Tools SQL注入漏洞
Form Tools is an open source codebase for Form Tools scripts, modules, themes and APIs. A SQL injection vulnerability exists in Form Tools version 3.1.1, which originates from allowing an attacker to run arbitrary SQL commands via keyword while searching for clients...
WordPress Search Keyword Redirect Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)
Software Search Keyword Redirect Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32080 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9a5522e4a000 Credits Sharanabasappa Required privilege...
CVE-2024-22719
An SQL Injection vulnerability exists in Form Tools version 3.1.1 . The flaw originates from the improper neutralization of special elements in the 'keyword' parameter used when searching for a client. This allows an attacker to execute arbitrary SQL commands by manipulating the search functional...
PT-2024-25893 · Wangshen · Wangshen Secgate 3600
Name of the Vulnerable Software and Affected Versions: Wangshen SecGate 3600 up to 20240408 Description: A critical issue affects an unknown part of the file "/?g=net pro keyword import save". The manipulation of the reqfile argument leads to unrestricted upload. It is possible to initiate the...
CVE-2024-28092
UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Ti...
CVE-2024-2357: Undefined Security Weakness
The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys authby=secret and the connection cannot find a matching configured secret. When such a connection is automatically added on startu...
CVE-2024-2351
A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file action.php of the component Search. The manipulation of the argument catid/brandid/keyword leads to sql injection. The attack can be launched...
Ecommerce-Website SQL Injection Vulnerability
Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. A SQL injection vulnerability exists in Ecommerce-Website version 1.0, which stems from the parameter catid/brandid/keyword in the file action.php that can lead to SQL injection...
PT-2024-18086
Name of the Vulnerable Software and Affected Versions registry-support versions prior to v0.0.0-20240206 Description A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which use...
GHSA-9XFW-JJQ2-7V8H 1Panel set-cookie is missing the Secure keyword
Summary The https cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text when accessing http accidentally. https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Set-Cookiesecure PoC Directly configure https for the panel, and the...
1Panel set-cookie is missing the Secure keyword
Summary The https cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text when accessing http accidentally. https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Set-Cookiesecure PoC Directly configure https for the panel, and the...
Code injection
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...
CVE-2024-24768 1Panel set-cookie is missing the Secure keyword
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...
CVE-2024-24768
What is affected : 1Panel, a Linux server operation and maintenance management panel. Vulnerability : The HTTPS session cookie used by 1Panel does not have the Secure attribute, which may allow the cookie to be exposed over non-HTTPS connections. Root cause / details in sources : Cookie missing S...
CVE-2024-24768 1Panel set-cookie is missing the Secure keyword
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...
CVE-2024-24768 1Panel set-cookie is missing the Secure keyword
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...
PT-2024-20546
Name of the Vulnerable Software and Affected Versions 1Panel versions prior to 1.9.6 Description The HTTPS cookie that comes with the 1Panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue affects everyone who has configured...
CVE-2024-24768: Cleartext Storage of Sensitive Information in a Cookie
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...