2458 matches found
CVE-2021-3243
Wfilter ICF 5.0.117 contains a cross-site scripting XSS vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to inject a payload in its logs, where an attacker can take over the system by through its plugin-running function...
PT-2021-19704
Name of the Vulnerable Software and Affected Versions: Wfilter ICF version 5.0.117 Description: The issue allows an attacker in the same LAN to inject a payload into the system's logs by crafting a packet with a malicious User-Agent header. This can lead to a takeover of the system through its...
CVE-2021-3243: Improper Neutralization of Input During Web Page Generation
Wfilter ICF 5.0.117 contains a cross-site scripting XSS vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to inject a payload in its logs, where an attacker can take over the system by through its plugin-running function...
GHSA-JXG6-FHWC-9V9C Regular Expression Denial of Service (ReDoS) in es6-crawler-detect
This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...
Regular Expression Denial of Service (ReDoS) in es6-crawler-detect
This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...
Business Directory Plugin < 5.11 - Arbitrary File Upload to RCE
The plugin suffered from a Cross-Site Request Forgery issue, allowing an attacker to make a logged in administrator import files. As the plugin also did not validate uploaded files, it could lead to RCE. Note WPScanTeam: CSRF check and some file validation were added in v5.11, however a blacklist...
research
Public CVE | CVE Number | Produc...
QIWI: SSRF на https://qiwi.com с помощью "Prerender HAR Capturer"
Здравствуйте! На сайте https://qiwi.com вы используете Prerender HAR Capturer 5.6.0 на основе Headless Chrome для рендеринга HTML, снимков экрана, PDF-файлов и файлов HAR с любой веб-страницы https://github.com/prerender/prerender. Если на qiwi.com послать запрос с измененным юзер-агентом...
PT-2021-3840
Name of the Vulnerable Software and Affected Versions Nacos versions prior to 1.4.1 Description Nacos is a platform for dynamic service discovery, configuration, and service management. When configured to use authentication via -Dnacos.core.auth.enabled=true, the system employs the AuthFilter...
CVE-2021-24177
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...
Default configuration
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...
CVE-2021-24177
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...
PT-2021-15723
Name of the Vulnerable Software and Affected Versions: File Manager WordPress plugin versions prior to 7.1 Description: A Reflected XSS issue can occur in the default configuration of the plugin when a payload is submitted on the User-Agent parameter. This payload is then reflected back on the we...
CVE-2021-24177: Improper Neutralization of Input During Web Page Generation
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...
Regular Expression Denial Of Service (ReDoS)
es6-crawler-detect is vulnerable to regular expression denial of service. The vulnerability exists because user agent string length supplied to regex operators are not restricted, leading to no limit for the time module being run...
CVE-2020-28501
This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...
CVE-2020-28501
This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...
Design/Logic Flaw
This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators...
