1412 matches found
Cross site scripting
Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting XSS vulnerability via the function renderError...
WordPress 插件跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin that stems from the fact that th...
CVE-2021-43558
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk...
Moodle Cross-Site Scripting Vulnerability (CNVD-2021-93379)
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. cross-site scripting vulnerability exists in Moodle, which stems from the lack of effective filtering and escaping of URL parameters in...
CVE-2021-42838
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...
Cross site scripting
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...
CVE-2021-42838
Summary: CVE-2021-42838 affects Grand Vice info Co. webopac7, where the book search field does not properly restrict special characters. Vulnerability details: Unauthenticated remote attackers can inject JavaScript syntax via the search input, enabling reflected XSS attacks. The root cause is ina...
CVE-2021-42838
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...
PT-2021-23692
Name of the Vulnerable Software and Affected Versions Grand Vice info Co. webopac7 affected versions not specified Description The issue concerns the book search field parameter in webopac7, which does not properly restrict the input of special characters. This allows unauthenticated attackers to...
CVE-2020-18259
ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting XSS vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields...
CVE-2020-18259
ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting XSS vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields...
Cross site scripting
ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting XSS vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields...
DCOM abuse and lateral movement with Cobalt Strike
Introduction When researching lateral movement techniques I came across a post from Raphael Mudge of Cobalt Strike fame. He details scripting an Aggressor Script for Matt Nelson’s MMC20.Application Lateral Movement technique. Reading that post spurred me to make my own DCOM based lateral movement...
PT-2021-10161
Name of the Vulnerable Software and Affected Versions: ED01-CMS version 1.0 Description: The issue is a reflective cross-site scripting XSS vulnerability in the sposts.php component. This allows attackers to execute arbitrary web scripts or HTML by inserting a crafted payload into the Post title ...
CVE-2021-35228
This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remo...
CVE-2021-35228
CVE-2021-35228 affects SolarWinds SolarWinds Database Performance Analyzer (DPA) in version 2021.3.7388, due to missing input sanitization of a header-extracted output field, enabling a reflected XSS if an attacker can perform a MITM to modify a header. The vulnerability is described as a reflect...
PT-2021-20851
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by missing input sanitization for an output field extracted from headers on a specific section of a page, leading to a reflective...
CVE-2021-21746
ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...