10760 matches found
Cross site scripting
Cross-site scripting vulnerability in pfSense CE and pfSense Plus pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier allows a remote attacker to inject an arbitrary script via a malicious URL...
Input validation
Improper input validation vulnerability in pfSense CE and pfSense Plus pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01 allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command...
CVE-2022-27496
CVE-2022-27496 : Cross-site scripting in Zero-channel BBS Plus before or equal to v0.7.4 allows a remote attacker to inject arbitrary scripts via unspecified vectors. The available connected documents confirm the vulnerability and its impact (XSS) but do not provide any concrete fix/version detai...
CVE-2022-27496
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
CVE-2022-26019
The CVE-2022-26019 issue affects pfSense CE/Plus: pfSense CE before 2.6.0 and pfSense Plus before 22.01. The root cause is improper access control that lets a remote attacker with privilege to modify NTP GPS settings rewrite files on the filesystem, potentially enabling arbitrary command executio...
CVE-2022-24299
The CVE-2022-24299 issue affects pfSense CE (versions prior to 2.6.0) and pfSense Plus (prior to 22.01); it is an Improper Input Validation vulnerability that lets a privileged attacker who can modify OpenVPN client/server settings execute arbitrary commands. This is documented across multiple so...
CVE-2021-20729
The CVE-2021-20729 entry concerns a Cross-site scripting (XSS) vulnerability in pfSense CE (versions <= 2.5.2) and pfSense Plus (versions
CVE-2021-20729
Cross-site scripting vulnerability in pfSense CE and pfSense Plus pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier allows a remote attacker to inject an arbitrary script via a malicious URL...
Spring Framework RCE via Data Binding on JDK 9+
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is...
CVE-2021-45031
A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords...
CVE-2021-45031
A vulnerability in MEPSAN's USC+ before version 3.0 has a weakness in login function which lets attackers to generate high privileged accounts passwords...
Zero-channel BBS Plus vulnerable to cross-site scripting
Overview Zero-channel BBS Plus by Zero-Channel BBS Plus Developers is a bulletin board CGI script. Zero-channel BBS Plus contains a cross-site scripting vulnerability CWE-79. Zero-Channel BBS Plus Developers reported this vulnerability to JPCERT/CC to notify users of its solution through JVN...
MEPSAN USC Plus 安全漏洞
MEPSAN USC Plus is an automation system from MEPSAN Turkey. A security vulnerability exists in the USC+ functionality prior to MEPSAN USC Plus version 3.0. An attacker could generate passwords for highly privileged accounts...
JVN#59576930: Zero-channel BBS Plus vulnerable to cross-site scripting
Zero-channel BBS Plus by Zero-Channel BBS Plus Developers is a bulletin board CGI script. Zero-channel BBS Plus contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who is accessing the management screen of the product,...
Falcon-plus SQL Injection Vulnerability (CNVD-2022-82590)
Falcon is an embedded programming language. An SQL injection vulnerability exists in Falcon-plus v0.3, which originates from the grpName parameter in /config/service/host.go. An attacker could exploit this vulnerability to cause SQL injection...
GHSA-76J4-GGGQ-7RG9 SQLinjection in falcon-plus
Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...
SQLinjection in falcon-plus
Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...
CVE-2022-26245
Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go...