Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the library does not properly validate user input, allowing an attacker to view the count of internal notes for a given issue...

Cross-Site Scripting (XSS)

gitlab is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape user input in multi-word milestone references in issue descriptions and comments, etc, allowing an attacker to inject and execute malicious javascript on victim's browser...

Remote Code Execution (RCE)

suricata is vulnerable to Remote Code Execution RCE. Lack of proper checking user input allows an attacker who controls an external source of Lua rules to upload and execute malicious code on the system...

Wifi Soft Unibox Administration 3.0 & 3.1 - SQL Injection Vulnerability

Exploit Title: Wifi Soft Unibox Administration 3.0 & 3.1 Login Page - Sql Injection Google Dork: intext:"Unibox Administration 3.1", intext:"Unibox 3.0" Exploit Author: Ansh Jain @sudoark Author Contact : email protected Vendor Homepage: https://www.wifi-soft.com/ Software Link:...

Network_Assessment - With Wireshark Or TCPdump, You Can Determine Whether There Is Harmful Activity On Your Network Traffic That You Have Recorded On The Network You Monitor

With Wireshark or TCPdump, you can determine whether there is harmful activity on your network traffic that you have recorded on the network you monitor. This Python script analyzes network traffic in a given .pcap file and attempts to detect the following suspicious network activities and attack...

Stack Overflow

libfaust.so is vulnerable to stack overlfow. The vulnerability is due to not restricting/sanitizing user input passed to the streambinopShared function resulting in infinite recursive calls to the boxppShared::print function in /boxes/ppbox.cpp file . The attacker can use this function to mount...

PT-2023-7418

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.0 Description The issue arises from improper validation, allowing an attacker to modify the HTTP request or create a new one if they control the HTTP version. This can lead to CRLF injection and Request Smuggling...

CVE-2023-37477 Command injection in firewall ip functionality in 1Panel

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

Input validation

The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50W series firmware versions 5.10 through 5.36, USG20W-VPN series firmware versions 5.10 through 5.36, and VP...

CVE-2023-28767

The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50W series firmware versions 5.10 through 5.36, USG20W-VPN series firmware versions 5.10 through 5.36, and VP...

CVE-2023-3041

The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack...

CVE-2023-3041 Autochat <= 1.1.7- Unauthenticated Stored XSS

The Autochat Automatic Conversation WordPress plugin through 1.1.7 does not sanitise and escape user input before outputting it back on the page, leading to a cross-site Scripting attack...

Cross-site Scripting (XSS)

tarteaucitronjs is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of user-input sanitization in width, theme, controls, img, and other parameters, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Remote Code Execution (RCE)

xalpha is vulnerable to Remote Code Execution RCE. The vulnerability exists in the basicinit function of info.py due to the use of the eval method without user input validation, which allows an attacker to execute malicious code in the system...

Cross-site Scripting (XSS)

decidim is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of user-input sanitization in external link redirections, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Zyxel ATP 操作系统命令注入漏洞

Zyxel ATP is a firewall from Zyxel. A security vulnerability exists in the Zyxel ATP ZLD versions V5.10 through V5.36, USG FLEX ZLD versions V5.00 through V5.36, USG FLEX 50W / USG20W-VPN ZLD versions V5.10 through V5.36, VPN ZLD versions V5.00 through V5.36, which stems from the inability of the...

Geeklog router.php cross-site scripting vulnerability

Geeklog is free and open source blogging software. A cross-site scripting vulnerability exists in Geeklog router.php due to an incorrect validation of user-supplied input by the publichtml/admin/router.php script. An attacker could exploit the vulnerability to steal the victim's cookie-based...

SUSE CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

CVE-2023-37473

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...

CVE-2023-37473 Limited code execution in zenstruck/collections

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...