CVE-2021-41567: Improper Neutralization of Input During Web Page Generation

The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks...

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Description Stored XSS in Subject in To Dos Proof of Concept // PoC Request POST /corebos/index.php HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:93.0 Gecko/20100101 Firefox/93.0 Accept:...

When data privacy and protection are rights, don’t get it wrong

Twenty-one years ago, Latanya Sweeney showed that it’s possible to uniquely identify 87% of Americans with just three pieces of personal data: gender, ZIP code and full date of birth. Long before anyone had heard the words ‘data lake’, ‘cloud storage’ or ‘big data’, nevermind ‘social media’, it w...

DEBIAN-CVE-2020-36477

An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name the cn argument of mbedtlsx509crtverify with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to an...

UBUNTU-CVE-2020-36477

An issue was discovered in Mbed TLS before 2.24.0. The verification of X.509 certificates when matching the expected common name the cn argument of mbedtlsx509crtverify with the actual certificate name is mishandled: when the subjecAltName extension is present, the expected name is compared to an...

ARM mbed TLS 信任管理问题漏洞

ARM mbed TLS is a product from ARM UK that provides secure communication and encryption capabilities for mbed products. A security vulnerability exists in ARM mbed TLS prior to version 2.24.0, which stems from an error in the validation handling of X.509 certificates when matching the expected...

Eclipse Mosquitto 输入验证错误漏洞

Eclipse Mosquitto is a set of open source messaging agent software from the Eclipse Foundation.An input validation error vulnerability exists in Eclipse Mosquitto 2.07 and earlier versions, which allows an attacker to crash the server by sending a PUBLISH packet with subject length = 0...

SourceCodester E-Commerce Website 跨站脚本漏洞

SourceCodester E-Commerce Website is an application. A PHP e-commerce website project for bookstores. SourceCodester E-Commerce Website v 1.0 is vulnerable to a cross-site scripting vulnerability that could be exploited to inject arbitrary web script or HTM into feedbackprocess.php via the subjec...

CVE-2021-25204: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SourceCodester E-Commerce Website v 1.0 allows remote attackers to inject arbitrary web script or HTM via the subject field to feedbackprocess.php...

Insecure SSL Certificate Validation

github.com/hashicorp/consul has a missing SSL certificate validation. The vulnerability exists due to the xds not ensuring that the subject Alternative Name of an upstream is validated...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

UBUNTU-CVE-2021-32574

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

CVE-2021-32574: Improper Certificate Validation

HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1...

PT-2021-6606 · Hashicorp +2 · Hashicorp Consul +3

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions 1.3.0 through 1.10.0 Description: The issue is related to the absence of validation of the destination service identity in the encoded subject alternative name in the Envoy proxy TLS...

MuWire 跨站脚本漏洞

MuWire is an open source file publishing and networking tool that uses 12P technology to protect the identity of its users.A security vulnerability in the desktop client prior to MuWire version 0.8.8 could be exploited by an attacker to send a message with a subject line containing a URL tagged...

CVE-2021-24494

The WP Offload SES Lite WordPress plugin before 1.4.5 did not escape some of the fields in the Activity page of the admin dashboard, such as the email's id, subject and recipient, which could lead to Stored Cross-Site Scripting issues when an attacker can control any of these fields, like the...

OpenCart 3.0.3.6 - (subject) Stored Cross-Site Scripting Vulnerability

Exploit Title: OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting Exploit Author: Mert Daş Vendor Homepage: https://www.opencart.com/ Software Link: https://www.opencart.com/index.php?route=cms/download Version: 3.0.3.7 Tested on: Windows 10 Stored Cross-site scriptingXSS: Stored XSS, also...

Qualcomm 组件缓冲区错误漏洞

The Qualcomm Component is a component of Qualcomm Incorporated USA. The intrinsic parts that provide the functionality of Qualcomm devices. A buffer error vulnerability exists in the Qualcomm component that stems from the fact that when processing server certificates from an IPSec server,...