nodejs-ua-parser-js: Regular expression denial of service via the regex

A flaw was found in nodejs-ua-parser-js. The software is vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA...

Cross-site Scripting (XSS) - DOM in alovoa/alovoa

✍️ Description It is possible to run JavaScript code in the webpage by DOM unsanitized properties. The function onChangeLocal sets the value of window.location.search directly from the URL, without previous checks. 🕵️‍♂️ Proof of Concept // Vulnerable function in file fragments.html:139 function...

WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal

Exploit Title: WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 - Directory Traversal Date: 05.07.2021 Exploit Author: TheSmuggler Vendor Homepage: https://gotmls.net/ Software Link: https://gotmls.net/downloads/ Version: = 4.20.72 Tested on: Windows import requests...

SQL Injection in NukeViet

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request e.g., Referer and User-Agent...

GHSA-P2C4-GXP4-J3XP Denial of service in Valine

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

Denial of service in Valine

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

Code injection

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

CVE-2021-34801

Valine 1.4.14 exposes a denial-of-service (application outage) when a remote attacker supplies a User-Agent value that only specifies the product and version. The description across multiple sources confirms the vulnerability is triggered via network input and impacts availability; no explicit ex...

Valine 代码注入漏洞

Valine is a review system. A security vulnerability exists in Valine version 1.4.14, which can be exploited by a remote attacker to cause a denial of service by providing a ua value that specifies only the product and version...

CVE-2021-34801: Undefined Security Weakness

Valine 1.4.14 allows remote attackers to cause a denial of service application outage by supplying a ua aka User-Agent value that only specifies the product and version...

WordPress Visitors plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Visitors is a plugin for WordPress. A cross-site scripting vulnerability exists in WordPress Visitors plugin version 0.3 and earlier,...

CVE-2021-24350

The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel...

CVE-2021-24350: Improper Neutralization of Input During Web Page Generation

The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel...

Visitors WordPress plugin 跨站脚本漏洞

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Visitors is a plugin for WordPress. A cross-site scripting vulnerability exists in WordPress Visitors plugin version 0.3 and earlier,...

PT-2021-15886

Name of the Vulnerable Software and Affected Versions Visitors WordPress plugin versions 0.3 and earlier Description The issue is related to an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. It occurs because the plugin displays the user's user agent string without proper validati...

Nebula - Cloud C2 Framework, Which At The Moment Offers Reconnaissance, Enumeration, Exploitation, Post Exploitation On AWS

Nebula is a Cloud and hopefully DevOps Penetration Testing framework. It is build with modules for each provider and each functionality. As of April 2021, it only covers AWS, but is currently an ongoing project and hopefully will continue to grow to test GCP, Azure, Kubernetes, Docker, or...