39 matches found
PMB platform 安全漏洞
PMB platform is a free document management software from PMB Inc. A security vulnerability exists in PMB platform versions 4.0.10 through 4.2.13, which originated from a vulnerability that allows an attacker to keep temporary files on the server...
CVE-2025-22614
WeGIA is affected by a Stored Cross‑Site Scripting (XSS) in the dependente_editarInfoPessoal.php endpoint, specifically via the nome and SobrenomeForm parameters. The vulnerability arises from inadequate input validation/sanitization, allowing attackers to store malicious scripts on the server th...
Pavel Durov Criticizes Outdated Laws After Arrest Over Telegram Criminal Activity
Telegram CEO Pavel Durov has broken his silence nearly two weeks after his arrest in France, stating the charges are misguided. "If a country is unhappy with an internet service, the established practice is to start a legal action against the service itself," Durov said in a 600-word statement on...
Sentry 安全漏洞
Sentry is Sentry's open source bug tracking and performance monitoring platform for developers. A security vulnerability exists in Sentry prior to version 24.7.1, which stems from a payload that can store arbitrary HTML tags on the Sentry side and can be displayed on the issue page...
CVE-2023-45723
HCL DRYiCE MyXalytics is impacted by path traversal vulnerability which allows file upload capability. Certain endpoints permit users to manipulate the path including the file name where these files are stored on the server...
CVE-2023-28025
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed a...
Cross site scripting
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed a...
CVE-2023-28025 An HTML injection vulnerability can affect HCL BigFix Mobile / Modern Client Management
Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabilities, a preventive measure involves thoroughly sanitizing and validating all user inputs before they are processed a...
CVE-2023-28025
CVE-2023-28025 affects HCL Technologies BigFix Mobile / Modern Client Management (including v3.1 and prior per multiple sources). The issue is a stored XSS via the ability to inject an SVG tag into HTML, resulting in an alert cookie pop-up. Root cause is improper input handling that allows SVG ma...
CVE-2023-6910 Uncontrolled Resource Consumption in M-Files Server
A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point where the server can no longer serve requests...
MariaDB 10.3.0 < 10.3.11 Multiple Vulnerabilities
The version of MariaDB installed on the remote host is prior to 10.3.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 10.3.11 advisory. - The crc32big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors...
Cipi 跨站脚本漏洞
Cipi is a Laravel-based cloud server control panel by the individual developer Andrea Pollastri in Italy. A security vulnerability exists in Cipi that allows adding server storage XSS via the api server name field...
CVE-2019-14530
An issue was discovered in custom/ajaxdownload.php in OpenEMR before 5.0.2 via the fileName parameter. An attacker can download any file that is readable by the user www-data from server storage. If the requested file is writable for the www-data user and the directory...
openSUSE Security Update : mariadb (openSUSE-2019-327)
This update for mariadb to version 10.2.22 fixes the following issues : Security issues fixed : - CVE-2019-2510: Fixed a vulnerability which can lead to MySQL compromise and lead to Denial of Service bsc1122198. - CVE-2019-2537: Fixed a vulnerability which can lead to MySQL compromise and lead to...
Amazon Linux AMI : mysql55 (ALAS-2018-1116)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Client programs. Supported versions that are affected are 5.5.61 and prior, 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the...
Amazon Linux AMI : mysql56 (ALAS-2018-1115)
Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: InnoDB. Supported versions that are affected are 5.6.41 and prior, 5.7.23 and prior and 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to...
Oracle MySQL Server Denial of Service Vulnerability (CNVD-2019-23148)
Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A denial of service vulnerability exists in the Server:Storage Engines component of Oracle MySQL Server. An attacker can exploit this vulnerability t...
XSS'OR - Hack with JavaScript
XSS'OR is a free online tool for hacking with JavaScript. It contains three major modules: 1. Encode/Decode The Encode/Decode module, including: front-end encryption and decryption; code compression, decompression, beautification, the implementation of testing; character set conversion, hash...
[ENABLESECURITY] Apple's Mail.app stores your S/MIME encrypted emails in clear text
Just published the below advisory describing an issue with Mail.app and a solution. I comment on the flaw on my blog: http://enablesecurity.com/2008/10/03/apple-mailapp-security-advisory/ An up to date version of the advisory can be found:...