Cisco Meraki Local Status Page Configuration Hardening

Cisco Meraki devices implement a Local Status Page LSP feature. This is a web-based interface that is primarily intended to provide administrators with the ability to apply configuration settings that are required for the device to connect to the Cisco Meraki Dashboard, perform local...

Uptime Kuma 1.19.6 Cross Site Scripting

Exploit Title: Stored XSS in uptime-kuma ""alert"XSS" If anyone loads the page, the javascript inside the script tag will be executed...

CVE-2023-26777

Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary commands via the description, title, footer, and incident creation parameter of the statuspage.js endpoint...

Uptime Kuma 跨站脚本漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from Louis Lam Personal Developer. A security vulnerability exists in Uptime Kuma versions prior to 1.20.0 that stems from the Uptime Kuma status page allowing persistent XSS attacks...

SUSE CVE-2012-5510

Xen 4.x, when downgrading the grant table version, does not properly remove the status page from the tracking list when freeing the page, which allows local guest OS administrators to cause a denial of service hypervisor crash via unspecified vectors...

SUSE CVE-2013-7106

Multiple stack-based buffer overflows in Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to cause a denial of service crash and possibly execute arbitrary code via a long string to the 1 displaynavtable, 2 pagelimitselector, 3 printexportlink, or 4...

CVE-2022-44348

Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/updatestatus.php?id=...

Badminton Center Management System SQL注入漏洞

Badminton Center Management System is a badminton center management system from Carlo Montero's personal developer. It provides an online and automated platform for badminton centers to manage their daily transactions and records.Badminton Center Management System version v1.0 is vulnerable to SQ...

JetBrains TeamCity Cross-Site Scripting Vulnerability (CNVD-2022-70084)

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. The tool provides continuous unit testing, code quality analysis, and build issue analysis reports.JetBrains TeamCity versions prior to 2022.04 have a cross-site scripting...

CVE-2022-30415

Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/admin/applications/updatestatus.php?id=...

Covid-19 Travel Pass Management System SQL注入漏洞

Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. A SQL injection vulnerability exists in Covid-19 Travel Pass Management System v1.0, which originates from /ctpms/admin/individuals/updatestatus.php?id=Lack of filtering and escaping for parameters, which can be...

CVE-2022-29998

Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?clientid=...

CVE-2022-29998

Insurance Management System 1.0 is vulnerable to SQL Injection via /insurance/clientStatus.php?clientid=...

CVE-2022-29927

In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible...

Kube-Applier - Enables Automated Deployment And Declarative Configuration For Your Kubernetes Cluster

kube-applier is a service that enables continuous deployment of Kubernetes objects by applying declarative configuration files from a Git repository to a Kubernetes cluster. kube-applier runs as a Pod in your cluster and watches the Git repo to ensure that the cluster objects are up-to-date with...

CVE-2021-35488

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined&title=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

CVE-2021-39174

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges User or Admin, can leak the value of any configuration entry of the dotenv file, e.g. the application secret APPKEY and various passwords email, database, etc. This issue was...

CVE-2021-39174

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges User or Admin, can leak the value of any configuration entry of the dotenv file, e.g. the application secret APPKEY and various passwords email, database, etc. This issue was...

CVE-2021-39174

Cachet prior to 2.5.1 allows authenticated users (any privilege) to leak values from the dotenv configuration, including APP_KEY and passwords. The root cause is updates to the dotenv file via UpdateConfigCommandHandler without proper validation, enabling newline/newline-like entries and, in some...

CVE-2021-39172

Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges User or Admin, can exploit a new line injection in the configuration edition feature e.g. mail settings and gain arbitrary code execution on the server. This issue was addresse...