10760 matches found
CVE-2021-43106
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...
CVE-2021-43106
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...
Design/Logic Flaw
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...
CVE-2021-43106
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the...
CVE-2021-43106
CVE-2021-43106 affects Compass Plus TranzWare Online FIMI Web Interface (TWO) version 5.3.33.3 F38 and FIMI 4.2.19.4. The root cause is improper validation/escaping of the HTTP Host header, leading the server to trust the Host header and redirect requests to a different Domain/IP. Documented impa...
CVE-2021-25115
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting XSS. Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel...
CVE-2021-25115
The CVE-2021-25115 entry concerns the WordPress plugin WP Photo Album Plus. Affected versions (prior to 8.0.10) are vulnerable to Stored Cross-Site Scripting (XSS) due to improper handling of error log content, permitting arbitrary JavaScript execution in the admin panel by any user, including un...
Compass Plus e-Commerce Payment Gateway 安全漏洞
Compass Plus e-Commerce Payment Gateway is an application interface of the Russian company Compass Plus. It provides an API interface for payment functions. A security vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online TWO 5.3.33.3 F38 and FIMI 4.2.19.4 25,...
WordPress和WordPress plugin 跨站脚本漏洞
WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions prior to WordPress WP Photo Album Plus plugin 8.0.10, which stems from improper...
CVE-2022-24568
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...
CVE-2022-24568
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...
Server side request forgery (ssrf)
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...
CVE-2022-24568
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...
CVE-2022-24568
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery SSRF via user-supplied crafted input...
CVE-2022-24568
CVE-2022-24568 affects Novel-plus v3.6.0, exposing a Server-Side Request Forgery (SSRF) flaw via user-supplied crafted input. In the provided documents, the vulnerability is described consistently across sources (NVD entry and Red Hat/PRION/OSV/CVE lists) as SSRF with high impact across confident...
The vulnerability of the Windows GDI+ component in Windows operating systems allows attackers to disclose sensitive information that is protected by security measures.
The vulnerability of the Windows GDI+ component in Windows operating systems is related to deficiencies in the system’s controlled areas. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...
PT-2022-16723 · Unknown · Novel-Plus
Name of the Vulnerable Software and Affected Versions: Novel-plus version 3.6.0 Description: The issue is related to Server-Side Request Forgery SSRF that can be triggered via user-supplied crafted input. Recommendations: For Novel-plus version 3.6.0, update to a version that fixes the Server-Sid...
CVE-2022-21241
Cross-site scripting vulnerability in CSV+ prior to 0.8.1 allows a remote unauthenticated attacker to inject an arbitrary script or an arbitrary OS command via a specially crafted CSV file that contains HTML a tag...
The vulnerability of the configuration of software solutions for Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus lies in the absence of authentication procedures, which allow attackers to execute arbitrary code.
The vulnerability of the configuration of software solutions for Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus lies in the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to execute...
CVE-2021-4198
A NULL Pointer Dereference vulnerability in the messagingipc.dll component as used in Bitdefender Total Security, Internet Security, Antivirus Plus, Endpoint Security Tools, VPN Standalone allows an attacker to arbitrarily crash product processes and generate crashdump files. This issue affects:...