481 matches found
PT-2021-14414 · Uap-Core · Uap-Core
Name of the Vulnerable Software and Affected Versions: uap-core versions prior to 0.11.0 Description: The issue concerns regular expression denial of service REDoS due to overlapping capture groups in some regexes. This allows remote attackers to overload a server by setting the User-Agent header...
maltrail
This is a malicious traffic detection system, utilizing publicly available blacklists containing malicious and/or generally suspicious trails. The system can detect various types of malicious traffic, including domain name, URL, IP address, and HTTP User-Agent header value. It also uses advanced...
CVE-2020-26574
Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a...
CVE-2020-26574
Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a...
PT-2020-16465 · Leostream · Leostream Connection Broker
Name of the Vulnerable Software and Affected Versions: Leostream Connection Broker versions 8.2.x Description: The issue allows an unauthenticated attacker to inject arbitrary JavaScript code via the User-Agent HTTP header in the webquery.pl file. This code is rendered by administrators the next...
CVE-2020-12645
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
Input validation
OX App Suite 7.10.1 to 7.10.3 has improper input validation for rate limits with a crafted User-Agent header, spoofed vacation notices, and /apps/load memory consumption...
UBUNTU-CVE-2020-15693
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...
Sql injection
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...
CVE-2020-15693
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...
CVE-2020-15693
In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker controls any part of the URL provided in a call such as httpClient.get or httpClient.post, the User-Agent header value, or custom HTTP header names or value...
PT-2020-13530 · Magento · Form Builder +1
Name of the Vulnerable Software and Affected Versions: Form Builder version 2.1.0 for Magento Description: The issue concerns multiple XSS problems that can be exploited against Magento 2 admin accounts. This can be achieved via the Current url or email field, or the User-Agent HTTP header...
Victor CMS 1.0 - 'add_user' Persistent Cross-Site Scripting
Exploit Title: Victor CMS 1.0 - 'adduser' Persistent Cross-Site Scripting Google Dork: N/A Date: 2020-05-23 Exploit Author: Nitya Nand Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: 1.0 Tested on: Linux C...
Denial Of Service (DoS)
uap-core is vulnerable to denial of service. A remote attacker is able to crash the application from excess resource consumption due to overlapping capture groups, by passing malicious values within the User-Agent header in a HTTP request for parsing...
PT-2020-18339 · Uap · Uap-Core
Name of the Vulnerable Software and Affected Versions: uap-core versions prior to 0.7.3 Description: The issue allows remote attackers to overload a server by setting the User-Agent header in an HTTPS request to maliciously crafted long strings. This is due to some regexes being vulnerable to...
TP-Link Wi-Fi extender User-Agent Header Injection CVE-2019-7406
A pre-authentication command injection vulnerability in TP-Link Wi-Fi extenders allows commands to be executed as root. The injection occurs when the User-Agent header of a request is passed to an execve system call. TP-Link RE365 Wi-Fi extender with firmware version 1.0.2, build 20180213 Rel...
Design/Logic Flaw
FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under "User Manager" in the control panel, the payload...
CVE-2019-17488
b3log Symphony aka Sym before 3.6.0 has XSS via the HTTP User-Agent header...