ASUS RT-AC52U_B1 Cross-Site Scripting Vulnerability

Asus Rt-Ac52UB1 is a dual-band wireless router from Asus China.A cross-site scripting vulnerability exists in ASUS RT-AC52UB1, which stems from the presence of invalid data filtering in ASUS RT-AC52U B1 version 3.0.0.4.380.10931, which could lead to user session hijacking. No detailed vulnerabili...

CVE-2021-46109

Invalid input sanitizing leads to reflected Cross Site Scripting XSS in ASUS RT-AC52UB1 3.0.0.4.380.10931 can lead to a user session hijack...

Cross site scripting

Invalid input sanitizing leads to reflected Cross Site Scripting XSS in ASUS RT-AC52UB1 3.0.0.4.380.10931 can lead to a user session hijack...

CVE-2021-46109

The CVE-2021-46109 issue concerns the ASUS RT-AC52U_B1 router (firmware 3.0.0.4.380.10931). Affected component: input handling where invalid input sanitizing enables reflected Cross-Site Scripting (XSS). Root cause: inadequate input validation/sanitization leads to a reflected XSS condition that ...

CVE-2021-46109

Invalid input sanitizing leads to reflected Cross Site Scripting XSS in ASUS RT-AC52UB1 3.0.0.4.380.10931 can lead to a user session hijack...

Cross-Site Request Forgery (CSRF) in opensourcepos/opensourcepos

Description CSRF on logout functionality. Attacker able to logout the user by sending malicious link Proof of Concept Impact This vulnerability is capable of logout the user session Note This is not an attack, it is a kind of annoyance to the user , though it is a valid csrf . By Using post metho...

Cross-Site Request Forgery (CSRF) in francoisjacquet/rosariosis

Description An attacker is able to log out a user if a logged-in user visits the attacker's website. Proof of Concept history.pushState'', '', '/' document.forms0.submit; Impact This vulnerability is capable of forging users to unintentional logout. More details One way GET could be abused here i...

Cross-site Scripting (XSS) - Generic in bigbluebutton/bigbluebutton

Description Shared notes panel is vulnerable to XSS when rendering a new note, due to missing username sanitization. Proof of Concept 1. 1.Start a new web conference and share the link with other people 2. 2.A malicious user joins the conference with the following username: 3. 3.As soon as the...

Cross-site Scripting (XSS) - DOM in emoncms/emoncms

Description EmonCMS 10.9.19 has a DOM-XSS vulnerability that is executed when javascript code is injected as imported data. Proof of Concept 1 - login into the app and browse to the section Feeds Import Data 2 - add alert1,a or 1638807909,alert2 in the CSV area. Then click on one of the empty fie...

Cross-site Scripting (XSS) - Generic in zikula/core

Description In zikula/core cross site scripting vulnerability is present in block module description field Proof of Concept 1. login to the demo account 2. go to blocks https://demo.ziku.la/blocks/admin/view 3. Add payload in title field and save 4 payload = " Impact This vulnerability is capable...

CVE-2021-43777

Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login via OAuth incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a Cross-Site Request Forgery...

CVE-2021-31852

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...

Cross site scripting

A Reflected Cross-Site Scripting vulnerability in McAfee Policy Auditor prior to 6.5.2 allows a remote unauthenticated attacker to inject arbitrary web script or HTML via the UID request parameter. The malicious script is reflected unmodified into the Policy Auditor web-based interface which coul...

Cross-site Scripting (XSS) - Stored in kunstmaan/kunstmaanbundlescms

Description In kunstmaan / kunstmaanbundlescms, menu form slug field is vulnerable to cross site scripting Proof of Concept 1. login to demo page 2. go to pages, open any page 3. go to menu , in slug feild place the payload and save, it will trigger. payload : " Impact This vulnerability is capab...

Cross-site Scripting (XSS) - Stored in kevinpapst/kimai2

Description Cross site scripting vulnerability in name field on customer edit form Proof of Concept place this payload in customer name field and save " Impact This vulnerability is capable of stolen the user session...

Sql injection

A SQL injection issue in pages/editfields/9ajax/addkeyword.php of ResourceSpace 9.5 and 9.6 rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user...

Deserialization of untrusted data

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

Apostrophe CMS Insufficient Session Expiration vulnerability

Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions. As a mitigation for older releases the user account in question can be archived 3.x or moved to...

Session Fixation

jupyterhub is vulnerable to session fixation. The vulnerability exists due to the incomplete logout in the single-user server. An attacker is able to reinstate another user's session if another active session is open...

CVE-2021-41247

JupyterHub is an open source multi-user server for Jupyter notebooks. In affected versions users who have multiple JupyterLab tabs open in the same browser session, may see incomplete logout from the single-user server, as fresh credentials for the single-user server only, not the Hub reinstated...