2894 matches found
CVE-2021-41765
A SQL injection issue in pages/editfields/9ajax/addkeyword.php of ResourceSpace 9.5 and 9.6 rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user...
Exploit for Deserialization of Untrusted Data in Flask-Caching_Project Flask-Caching
CVE-2021-33026 Pickle Serialization Remote Code Execution - Me...
CVE-2021-25876: Improper Neutralization of Input During Web Page Generation
AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...
CVE-2021-25875: Improper Neutralization of Input During Web Page Generation
AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...
CVE-2021-26589
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting XSS because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE...
CVE-2021-26589
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting XSS because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE...
Cross site scripting
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting XSS because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE...
HPE Superdome Flex Server č·Øē«čę¬ę¼ę“
HPE Superdome Flex Server is a modular server product from Hewlett Packard Enterprise hpe. A cross-site scripting vulnerability exists in HPE Superdome Flex Servers that stems from a session cookie missing an HttpOnly attribute...
CVE-2021-26589: Incorrect Permission Assignment for Critical Resource
A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting XSS because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE...
PT-2021-17065
Name of the Vulnerable Software and Affected Versions HPE Superdome Flex Servers affected versions not specified Description A potential security issue has been identified, which could be remotely exploited to allow Cross Site Scripting XSS because the Session Cookie is missing an HttpOnly...
Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
āļø Description The persistent or stored XSS vulnerability is a more devastating variant of a cross-site scripting flaw, it occurs when the data provided by the attacker is saved by the server, and then permanently displayed on "normal" pages returned to other users in the course of regular...
CVE-2021-3882
LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection HTTP, an attacker may be able to obtain the authentication data by capturing network...
CVE-2021-3882
LedgerSMB does not set the 'Secure' attribute on the session authorization cookie when the client uses HTTPS and the LedgerSMB server is behind a reverse proxy. By tricking a user to use an unencrypted connection HTTP, an attacker may be able to obtain the authentication data by capturing network...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in bytebase/bytebase
Description Session cookie is not marked with 'Secure' Proof of Concept Login to demo page https://demo.bytebase.com/ Open Firefox developer option - storage - check secure option Below link shows POC https://i.ibb.co/DLG1pyt/Screenshot-48.png...
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in publify/publify
Description Session cookie publifyblogsession is not marked with 'Secure' Proof of Concept Login to demo page https://demo-publify.herokuapp.com/ Open Firefox developer option - storage - check secure option Below link shows POC https://i.ibb.co/j3K5YDg/Screenshot-45.png...
DMA Softlab Radius Manager 4.4.0 Session Management / Cross Site Scripting Exploit
DMA Softlab Radius Manager version 4.4.0 chained exploit written in go that exploits session management and cross site scripting vulnerabilities. package main import "github.com/gorilla/mux" "fmt" "net/http" "net/url" "flag" "strings" "io/ioutil" "log" / should be able to: 1. Inject javascript in...
DMA Softlab Radius Manager 4.4.0 Session Management / Cross Site Scripting
package main import "github.com/gorilla/mux" "fmt" "net/http" "net/url" "flag" "strings" "io/ioutil" "log" / should be able to: 1. Inject javascript into vulnerable fields. This will capture session cookies ofusers with higher privileges. 2. Send the captured session cookie to a server we control...
in fisharebest/webtrees
āļø Description A malicious actor, either logged in as an admin or after intercepting a request, is able to modify the path argument in the delete-path route, and can arbitrarily delete index.php or config.ini.php, rendering the site unusable. šµļøāāļø Proof of Concept 1; An admin should navigate to...
CVE-2021-38143
An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when...
Owncloud ownCloud ęęé®é¢ę¼ę“
Owncloud ownCloud is a personal cloud storage solution from the US-based ownCloud Owncloud. An authorization issue vulnerability exists in ownCloud Server, which stems from a session cookie not being reset after authenticating against a public link. An attacker could exploit this vulnerability to...