Cross-Site Request Forgery (CSRF)

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe can't PUT from an HTML form or such but POST allows creating...

ScratchOAuth2 跨站脚本漏洞

Kenny2github ScratchOAuth2 is a Kenny2github open source application. Verify that a Scratch account is authentic for authorization or identification purposes. ScratchOAuth2 has a cross-site scripting vulnerability that stems from the lack of effective filtering and validation of user-submitted...

Cross-Site Request Forgery (CSRF)

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe can't PUT from an HTML form or such but POST allows creating...

CVE-2020-26728

A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42multi and Tenda AC9 V1.0 V15.03.05.196318CN which allows for remote code execution via shell metacharacters in the guestuser field to the fastcall function with a POST request...

CVE-2020-26728

A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42multi and Tenda AC9 V1.0 V15.03.05.196318CN which allows for remote code execution via shell metacharacters in the guestuser field to the fastcall function with a POST request...

Remote code execution

A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42multi and Tenda AC9 V1.0 V15.03.05.196318CN which allows for remote code execution via shell metacharacters in the guestuser field to the fastcall function with a POST request...

Tenda AC9 安全漏洞

Tenda AC9, a wireless router from Tenda China, is vulnerable to a security flaw in Tenda AC9 v3.0 that allows remote execution of code via shell metacharacters in the guestuser field to a fastcall function request with POST. No details of the vulnerability are currently available...

Home Owners Collection Management System 1.0 - Account Takeover Vulnerability

Exploit Title: Home Owners Collection Management System 1.0 - Account Takeover Unauthenticated Exploit Author: Saud Alenazi Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/15162/home-owners-collection-management-system-phpoop-free-source-code.htm...

GHSA-J4F2-536G-R55M Resource exhaustion in engine.io

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service resource consumption via a POST request to the long polling transport...

Resource exhaustion in engine.io

Engine.IO before 4.0.0 and 3.6.0 allows attackers to cause a denial of service resource consumption via a POST request to the long polling transport...

Cross-site Scripting in Eclipse Hawkbit

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 Not Found JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client...

GHSA-RCVX-RMVF-MXCH Cross-site Scripting in Eclipse Hawkbit

In all version of Eclipse Hawkbit prior to 0.3.0M7, the HTTP 404 Not Found JSON response body returned by the REST API may contain unsafe characters within the path attribute. Sending a POST request to a non existing resource will return the full path from the given URL unescaped to the client...

Apache Traffic Control code issue vulnerability

Apache Traffic Control is a distributed, scalable content distribution solution from the Apache Foundation. Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6 was vulnerable to a code issue that allowed unprivileged users who could reach traffic operations via HTTPS to send a special POST...

8x8 Bounty: connect.8x8.com: admin user can send invites on behalf of another admin user via POST /api/v1/users/<User ID>/invites

Vulnerability description not provided...

GHSA-WP47-9R3H-XFGQ Server-Side Request Forgery in Apache Traffic Control

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

Server-Side Request Forgery (SSRF)

In Apache Traffic Control Traffic Ops, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

CVE-2022-23206 Server-Side Request Forgery in Traffic Ops endpoint POST /user/login/oauth

In Apache Traffic Control Traffic Ops prior to 6.1.0 or 5.1.6, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...

Server-Side Request Forgery (SSRF)

In Apache Traffic Control Traffic Ops, an unprivileged user who can reach Traffic Ops over HTTPS can send a specially-crafted POST request to /user/login/oauth to scan a port of a server that Traffic Ops can reach...