16080 matches found
Smart Office 安全漏洞
Smart Office is an office application. A security vulnerability exists in Smart Office, which stems from Main.aspx contains unknown functions that result in weak passwords via specific parameters...
CVE-2024-32028 Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore
OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore the url.full writes attribute/tag on spans Activity when tracing is enabled for outgoing http requests and...
Improper Removal of Sensitive Information Before Storage or Transfer
Overview OpenTelemetry.Instrumentation.Http is a Http instrumentation for OpenTelemetry .NET Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to the logging of sensitive query parameters by default. This behavior occurs...
Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore
Impact OpenTelemetry.Instrumentation.Http writes the url.full attribute/tag on spans Activity when tracing is enabled for outgoing http requests and OpenTelemetry.Instrumentation.AspNetCore writes the url.query attribute/tag on spans Activity when tracing is enabled for incoming http requests...
CVE-2024-30845
Cross Site Scripting vulnerability in Rainbow external link network disk v.5.5 allows a remote attacker to execute arbitrary code via the validation component of the input parameters...
CVE-2024-30845
Rainbow external link network disk v.5.5 is affected by a Cross Site Scripting vulnerability. The issue arises in the validation component of input parameters and can allow a remote attacker to execute arbitrary code. Public documents consistently describe the vulnerability and affected version b...
PT-2024-23629 · Rainbow · Rainbow
Name of the Vulnerable Software and Affected Versions: Rainbow external link network disk version 5.5 Description: The issue allows a remote attacker to execute arbitrary code via the validation component of the input parameters. This is a Cross Site Scripting vulnerability. Recommendations: For...
SAP Business Connector Cross-Site Scripting Vulnerability (CNVD-2024-20439)
SAP Business Connector is a middleware from SAP, Germany. A cross-site scripting vulnerability exists in SAP Business Connector version 4.8, which can be exploited by an attacker to add malicious GET query parameters to a service call to conduct a reflective cross-site scripting attack...
CVE-2024-3614
A vulnerability classified as problematic has been found in SourceCodester Warehouse Management System 1.0. This affects an unknown part of the file customer.php. The manipulation of the argument namacustomer/alamatcustomer/notelpcustomer leads to cross site scripting. It is possible to initiate...
CVE-2024-3613
A vulnerability was found in SourceCodester Warehouse Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file supplier.php. The manipulation of the argument namasupplier/alamatsupplier/notelpsupplier leads to cross site scripting...
CVE-2024-31997 XWiki Platform remote code execution from account through UIExtension parameters
XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. Th...
XWiki Platform remote code execution from account through UIExtension parameters
Impact Parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. Any user with edit right on any document like the user's own profile can create UI extensions. This allows remote code execution and thereby impacts the confidentiality, integrity and...
NULL Pointer Dereference
JGraphT Core is vulnerable to NULL Pointer Dereference. The vulnerability is caused by a lack of null value validation in the org.jgrapht.alg.util.ToleranceDoubleComparator::compareDouble, Double method, which results in a NullPointerException if an attacker can pass a null value to one of the...
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to perform cross-site scripting attacks.
The vulnerability of the Cargo extension for implementing the MediaWiki hypertext environment exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks through parameters of...
PT-2024-2885 · Juniper Networks · Junos
Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 20.4R3-S9 Juniper Networks Junos OS 21.2 versions prior to 21.2R3-S7 Juniper Networks Junos OS 21.3 versions prior to 21.3R3-S5 Juniper Networks Junos OS 21.4 versions prior to 21.4R3-S4 Juniper...
Warehouse Management System 跨站脚本漏洞
Warehouse Management System is a Warehouse Management System by Carlo Montero, an individual developer. A cross-site scripting vulnerability exists in SourceCodester Warehouse Management System version 1.0, which is caused by an unknown function in supplier.php, via the...
XWiki Platform 安全漏洞
XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform, which stems from a UI extension whose parameters are always interpreted as Velocity code and executed with programmatic privileges. This...
SAP Business Connector 跨站脚本漏洞
SAP Business Connector is a middleware from SAP, Germany. A cross-site scripting vulnerability exists in SAP Business Connector version 4.8, which can be exploited by an attacker to add malicious GET query parameters to a service call to conduct a reflective cross-site scripting attack...
WordPress Plugin Essential Addons for Elementor 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...