38 matches found
Graylog Web Interface 跨站脚本漏洞
The Graylog Web Interface is a web interface provided by the American company Graylog. Version 2.2.3 of the Graylog Web Interface contained a cross-site scripting vulnerability. This vulnerability stemmed from insufficient cleaning and escaping of HTML output, which could allow arbitrary JavaScri...
CVE-2026-22917
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...
CVE-2026-22917
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...
CVE-2026-22917
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...
CVE-2026-22917
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...
CVE-2026-22917
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...
EUVD-2026-2815
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...
CVE-2026-22917
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...
CVE-2026-22917
CVE-2026-22917 describes improper input handling in a system endpoint that may lead to resource exhaustion and a denial of service. The CVE is reflected in multiple feeds: NVD/Red Hat entries reiterate the same description and note a high availability impact (CVSS v3.1 base score 7.5) with networ...
PT-2026-2998
Name of the Vulnerable Software and Affected Versions versions prior to 2026-22917 Description Improper input handling in a system endpoint can lead to resource exhaustion and a denial of service. An attacker may be able to overload system resources, resulting in service disruption. Recommendatio...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the variableList function of the /admin/system/variableList.do endpoint when handling the Description argument. An attacker can inject and execute arbitrary scripts in the context of a user's browser by...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the variableSave function of the /admin/system/variableList.do endpoint when handling the Description argument. An attacker can inject and execute arbitrary scripts in the context of a user's browser by...
PT-2025-52282
Name of the Vulnerable Software and Affected Versions Dify version 1.9.1 Description Dify version 1.9.1 has an issue with insecure permissions. An attacker who is not authenticated can send HTTP GET requests to the /console/api/system-features API endpoint without providing any authentication. Th...
R Radio Network FM Transmitter 安全漏洞
R Radio Network FM Transmitter is an FM transmitter from R Radio Network Thailand. A security vulnerability exists in R Radio Network FM Transmitter version 1.07, which originates from a system.cgi endpoint that discloses the administrator password, which could lead to authentication bypass...
CVE-2022-29982
Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/maintenance/manageservice.php?id=...
CVE-2024-22819
FlyCms v1.0 contains a Cross-Site Request Forgery CSRF vulnerability via /system/email/emailtempletsupdate...
PT-2022-27692 · Kubeview · Kubeview
Name of the Vulnerable Software and Affected Versions: KubeView versions 0.1.31 and earlier Description: The issue allows attackers to obtain control of a Kubernetes cluster because the api/scrape/kube-system endpoint does not require authentication, and it retrieves certificate files that can be...