13582 matches found
CVE-2021-40604
A Server-Side Request Forgery SSRF vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated us...
CVE-2021-40604
CVE-2021-40604 affects IPS Community Suite prior to 4.6.2, where an SSRF vulnerability exists that can be triggered by remote authenticated users, with possible unauthenticated exploitation in some cases. The root cause involves dynamic class-name generation that can trigger deserialization via t...
Information Disclosure
guzzlehttp/guzzle is vulnerable to information disclosure. The vulnerability exists because the modifyRequest function of RedirectMiddleware.php does not properly strip the authorization header or cookie header on a change in host or HTTP downgrade, allowing an attacker to get sensitive informati...
Jeeves - Time-Based Blind SQLInjection Finder
Jeeves is made for looking to Time-Based Blind SQLInjection through recon. - Installation & Requirements: Installing Jeeves $ go install github.com/ferreiraklet/Jeeves@latest OR $ git clone https://github.com/ferreiraklet/Jeeves.git $ cd Jeeves $ go build jeeves.go $ chmod +x jeeves $ ./jeeves...
Facebook users targeted in massive phishing campaign
Facebook is once again the launchpad for a large-scale phishing campaign, according to researchers at PIXM. The campaign, which first shows signs of life back in September 2021, has generated millions of page views and ad referral revenue "estimated to be millions of USD at this scale of...
CVE-2022-32269
In Real Player 20.0.8.310, the G2 Control allows injection of unsafe javascript: URIs in local HTTP error pages displayed by Internet Explorer core. This leads to arbitrary code execution...
Open Redirect
github.com/caddyserver/caddy is vulnerable to open redirect attacks. A remote unauthenticated attacker is able to redirect users to arbitrary web URLs by tricking the victim to click on specifically crafted links...
CVE-2022-29718
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...
CVE-2022-29718
Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links...
CLSA-2022-1654106859 Fix CVE(s): CVE-2022-0391
SECURITY UPDATE: Injection attack - debian/patches/CVE-2022-0391.patch: sanitize urls in urllib.parse when it containing ASCII newline and tabs in Doc/library/urllib.parse.rst, Lib/test/testurlparse.py, Lib/urllib/parse.py. - CVE-2022-0391...
CURCY < 2.1.18 - Reflected Cross-Site Scripting
The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=wc-reports"...
Spectra < 1.25.6 - Reflected Cross-Site Scripting
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC When the admin notice about Usage Tracking is displayed: https://example.com/wp-admin/index?a"...
Age Gate < 2.20.4 - Reflected Cross-Site Scripting
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC With the "Age Gate User Registration" addon installed: https://example.com/wp-admin/admin.php?page=age-gate" With any addon installed:...
Video Conferencing with Zoom < 3.9.3 - Reflected Cross-Site Scripting
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/edit.php?posttype=zoom-meetings=zoom-video-conferencing-settings"...
Germanized for WooCommerce < 3.9.5 - Reflected Cross-Site Scripting
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=wc-settings=germanized"...
New User Approve < 2.4.1 - Reflected Cross-Site Scripting
The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC With the Membership settings /wp-admin/options-general.php disabled: https://example.com/wp-admin/index.php?a"...
CVE-2022-29452
Authenticated editor or higher user role Stored Cross-Site Scripting XSS vulnerability in Export All URLs plugin = 4.1 at WordPress...
Path Traversal
github.com/hashicorp/go-getter is vulnerable to path traversal. An attacker can access files outside the expected directory and download files or directories from various sources using malicious URLs by providing malicious inputs...
Opencast < 10.6 Unauthorized File Access Vulnerability
Opencast is prone to a unauthorized file access vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...
Authentication Bypass
Opencast-ingest-service-impl is vulnerable to authentication bypass. The vulnerability exists in addContentToRepo function in IngestServiceImpl.java because opencast doesn't properly restrict users when passing URLs which allows an attacker to gain access and bypass organizational barriers...