509 matches found
CVE-2024-26263
EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query sensitive data without login...
CVE-2024-26263
Summary: CVE-2024-26263 pertains to EBM Technologies RISWEB where a URL path is not properly controlled by permissions, enabling attackers to browse specific pages and query sensitive data without login. The core issue is improper access control affecting RISWEB’s URL paths; exploitation details ...
DEBIAN-CVE-2024-1019
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string...
CVE-2024-1019
ModSecurity / libModSecurity 3.0.0 to 3.0.11 is affected by a WAF bypass for path-based payloads submitted via specially crafted request URLs. ModSecurity v3 decodes percent-encoded characters present in request URLs before it separates the URL path component from the optional query string...
Design/Logic Flaw
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...
CVE-2023-5876 Regex DoS from a malicious server enrolled in Desktop
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...
CVE-2023-5876
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...
PT-2023-32391
Name of the Vulnerable Software and Affected Versions Mattermost affected versions not specified Description The issue arises from Mattermost's failure to properly validate a RegExp built off the server URL path. This allows an attacker in control of an enrolled server to mount a Denial Of Servic...
CVE-2023-5876: Uncontrolled Resource Consumption
Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Service...
Mattermost Security Vulnerabilities
Mattermost is an open source collaboration platform from US-based Mattermost. A security vulnerability exists in Mattermost version 5.5.0 and prior versions, which stems from an inability to properly validate a regular expression constructed based on the path to a server URL, resulting in a denia...
CVE-2023-39000
A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...
CVE-2023-39000
A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...
CVE-2023-39000
A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...
CVE-2023-39000
A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...
CVE-2023-39000
A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...
CVE-2023-39000: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...
OpenTelemetry Instrumentation for Java Information Disclosure Vulnerability
OpenTelemetry Instrumentation for Java is an OpenTelemetry open source Java agent JAR. An information disclosure vulnerability exists in OpenTelemetry Instrumentation for Java prior to version 1.28.0, which stems from the fact that when detecting a SES POST request, the request's query parameter ...
Social-Commerce 3.1.6 Cross Site Scripting
Exploit Title: Social-Commerce 3.1.6 - Reflected XSS Exploit Author: CraCkEr Date: 28/07/2023 Vendor: mooSocial Vendor Homepage: https://moosocial.com/ Software Link: https://social-commerce.moosocial.com/ Tested on: Windows 10 Pro Impact: Manipulate the content of the site CVE: CVE-2023-4174...
