1435 matches found
CVE-2022-20613
A cross-site request forgery CSRF vulnerability was found in the Jenkins Mailer plugin. The form validation method does not require POST requests...
Win32.MarsStealer Web Panel Cross Site Scripting
Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faaB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Win32.MarsStealer Web Panel Vulnerability: Unauthenticated Remote Persistent XSS Description: The...
CVE-2021-45468
Imperva Web Application Firewall WAF before 2021-12-23 allows remote unauthenticated attackers to use "Content-Encoding: gzip" to evade WAF security controls and send malicious HTTP POST requests to web servers behind the WAF...
PT-2022-12366 · Imperva · Imperva Web Application Firewall
Name of the Vulnerable Software and Affected Versions: Imperva Web Application Firewall WAF versions prior to 2021-12-23 Description: The issue allows remote unauthenticated attackers to use Content-Encoding: gzip to evade security controls and send malicious HTTP POST requests to web servers...
CVE-2019-11712
POST requests made by NPAPI plugins, such as Flash, that receive a status 308 redirect response can bypass CORS requirements. This can allow an attacker to perform Cross-Site Request Forgery CSRF attacks. This vulnerability affects Firefox ESR 60.8, Firefox 68, and Thunderbird 60.8...
Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin
Jenkins Mailer Plugin prior to 408.vd726a1130320 and 1.34.2 does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname. Additionally, this form...
GHSA-W4JV-6RG4-PR4M Cross-Site Request Forgery in Jenkins Bitbucket Branch Source Plugin
Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery CSRF vulnerability. This allows attackers with Overall/Read access to connect to an...
U.S. Dept Of Defense: CVE-2021-42567 - Apereo CAS Reflected XSS on https://█████████
Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. CAS is vulnerable to a Reflected Cross-Site Scripting attack, via POST requests sent to the REST API endpoints. The payload could be injected on URLs: /███████/. Malicious scripts can be submitted to CAS via...
Denial of Service in soketi
Impact What kind of vulnerability is it? Who is impacted? There was a wrong behavior when reading POST requests, making the server crash if it couldn't read the body. In case a POST request was sent to any endpoint of the server with an empty body, even unauthenticated with the Pusher Protocol, i...
CVE-2022-21667 Denial of Service in soketi
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...
CVE-2022-21667 Denial of Service in soketi
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...
CVE-2022-21667 Denial of Service in soketi
soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the body of a request. In the event that a POST request is sent to any endpoint of the server with an empty body, even unauthenticated with t...
The vulnerability of the FUN_800462c4 function (/formAdvFirewall) of the D-Link DIR-809 wireless router allows a hacker to execute any code on the target system.
The vulnerability of the FUN800462c4 /formAdvFirewall function in the wireless router software from D-Link, the DIR-809, is related to stack buffer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code within the system through the created POST request...
Anuko Time Tracker SQL Injection Vulnerability
Anuko Time Tracker is an open source time counting system for individual developers. A platform used to count employee time spent on various tasks, Anuko Time Tracker is vulnerable to a SQL injection vulnerability that stems from the group and status parameters in the groups.php file not being...
Anuko Time Tracker SQL注入漏洞
Anuko Time Tracker is an open source time counting system for individual developers. A platform used to count employee time spent on various tasks, Anuko Time Tracker is vulnerable to a SQL injection vulnerability that stems from the group and status parameters in the groups.php file not being...
PT-2021-7782 · Schneider Electric · Evlink City +2
Name of the Vulnerable Software and Affected Versions: EVlink City versions prior to R8 V3.4.0.2 EVlink Parking versions prior to R8 V3.4.0.2 EVlink Smart Wallbox versions prior to R8 V3.4.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This vulnerability...
GHSA-GFHX-JJWQ-63GV Cross-site Scripting in Apereo CAS
Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints...
GHSA-553Q-HPVP-Q8PC Server-Side Request Forgery in snipe/snipe-it
Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...
