506 matches found
silverstripe framework 跨站脚本漏洞
silverstripe framework is a CMS web framework. A security vulnerability exists in silverstripe framework version 4.11 and earlier, which originates from allowing XSS to exist via the href attribute of a link...
SilverStripe 跨站脚本漏洞
SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . A cross-site scripting vulnerability exists in SilverStripe 4.11 and earlier versions...
PT-2022-24239 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions 4.11 and earlier Description: The issue allows for XSS attacks. A malicious content author could upload a GPX file with a Javascript payload. The payload could then be executed by luring a legitima...
PT-2022-23994 · Silverstripe · Silverstripe/Framework
Name of the Vulnerable Software and Affected Versions: Silverstripe silverstripe/framework versions through 4.11 Description: The issue allows for an XSS vulnerability via the href attribute of a link. A malicious content author could add a JavaScript payload to the href attribute. This is simila...
PT-2022-35210 · Linux · Linux Kernel
Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v4.17 through v5.15.76 Description: A null pointer dereference issue was discovered in the tipc topsrv accept function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kerne...
PT-2022-24798
Name of the Vulnerable Software and Affected Versions HelpSystems Cobalt Strike versions through 4.7 Description A Cross Site Scripting XSS issue was found that allows a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit this issue, an attacker must first inspect a Cobalt...
Penta Security Systems WAPPLES 信任管理问题漏洞
Penta Security Systems WAPPLES is a logical web application firewall from Penta Security Systems, India. A security vulnerability exists in Penta Security Systems WAPPLES versions 4.0., 5.0.0. and 5.0.12., which stems from incorrect access control...
CVE-2022-36556
Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08executeping01...
DSpace 输入验证错误漏洞
DSpace is an open source turnkey repository application from the DuraSpace community. An input validation error vulnerability exists in DSpace versions 4.0 through 6.3, which stems from the vulnerability of a JSPUI-controlled vocabulary servlet to an open redirection attack, where an attacker can...
DSpace 路径遍历漏洞
DSpace is an open source turnkey repository application from the DuraSpace community. A path traversal vulnerability exists in DSpace versions 4.0 through 6.3, which stems from the intention that the SAF Simple Archive Format package could lead to the creation of files/directories in any location...
WordPress plugin PDF24 Articles To PDF 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress PDF24 Articles To PDF plugin 4.2.2 and earlier versions have a cross-site request forgery...
CVE-2022-31248
A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid usernames. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46-1. SUSE Manager Server 4.2 spacewalk-java...
Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2, when serving as an OAuth 2.0 Service Provider. There is low entropy for authorization data...
Mattermost Server vulnerable to Denial of Service through `@` character prefix inserted into JavaScript field names
An issue was discovered in Mattermost Server before 4.5.0, 4.4.5, 4.3.4, and 4.2.2. It allows attackers to cause a denial of service application crash via an @ character before a JavaScript field name...
CVE-2022-26531
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versions 4.09 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, VPN series firmware versions 4.30 through 5.21, NSG...
CVE-2021-22531
A bug exist in the input parameter of Access Manager that allows supply of invalid character to trigger cross-site scripting vulnerability. This affects NetIQ Access Manager 4.5 and 5.0...
CVE-2022-25619
Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause run arbitrary code. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86...
Profelis IT Consultancy SambaBox 跨站脚本漏洞
Profelis IT Consultancy SambaBox is an enterprise directory solution from Profelis IT Consultancy. A security vulnerability exists in Profelis IT Consultancy SambaBox x86 version 4.0 and prior versions, which stems from a disambiguation of script-related HTML tags in web pages in the Groups featu...
Joomla! 代码注入漏洞
Joomla! is a set of forum components used in the Joomla! content management system. A code injection vulnerability exists in versions 4.0.0 to 4.1.0 of Joomla!, which stems from an HTTP request parameter input validation error. No detailed vulnerability details are available at this time...