PT-2021-19219

Name of the Vulnerable Software and Affected Versions CHIYU Technology BF-630 CHIYU Technology BF-450M CHIYU Technology BF-430 CHIYU Technology BF-431 CHIYU Technology BF631-W CHIYU Technology BF830-W CHIYU Technology Webpass CHIYU Technology SEMAC Description An open redirect issue exists in...

CHIYU IoT devices - (Multiple) Cross-Site Scripting Vulnerability

Exploit Title: CHIYU IoT devices - 'Multiple' Cross-Site Scripting XSS Exploit Author: sirpedrotavares Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html Software Link: https://www.chiyu-tech.com/category-hardware.html Version: BF-430, BF-431, BF-450M, BF-630, BF631-W, BF830-W, Webpass,...

CVE-2021-31641: Improper Neutralization of Input During Web Page Generation

An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated...

PT-2021-3638

Name of the Vulnerable Software and Affected Versions Instant Images – One Click Unsplash Uploads WordPress plugin versions prior to 4.4.0.1 Description The issue is related to the improper validation and sanitization of the unsplash download w and unsplash download h parameter settings in the...

SUSE SLES12 Security Update : nghttp2 (SUSE-SU-2021:0932-1) (Data Dribble) (Resource Loop)

This update for nghttp2 fixes the following issues : Security issues fixed : CVE-2020-11080: HTTP/2 Large Settings Frame DoS bsc1181358. CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service bsc1146184. CVE-2019-9511: Fixed...

SUSE-SU-2021:0932-1 Security update for nghttp2

This update for nghttp2 fixes the following issues: Security issues fixed: - CVE-2020-11080: HTTP/2 Large Settings Frame DoS bsc1181358. - CVE-2019-9513: Fixed HTTP/2 implementation that is vulnerable to resource loops, potentially leading to a denial of service bsc1146184. - CVE-2019-9511: Fixed...

Weak Password Vulnerability in Huawei USG2130BSR-W Login System

Huawei is a leading global provider of information and communications solutions. A weak password vulnerability exists in the Huawei USG2130BSR-W login system, which can be exploited by attackers to obtain sensitive information...

CentOS 8 : virt:rhel (CESA-2020:4059)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4059 advisory. - QEMU: slirp: networking out-of-bounds read information disclosure vulnerability CVE-2020-10756 - QEMU: usb: out-of-bounds r/w access issue while...

CVE-2020-35517

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices...

CVE-2020-35517

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices...

CVE-2020-35517

A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is able to create a device special file in the shared directory and use it to r/w access host devices...

Sony Playstation 4 ValidationMessage::buildBubbleTree() Use-After-Free

const OFFSETELEMENTREFCOUNT = 0x10; const OFFSETJSABVIEWVECTOR = 0x10; const OFFSETJSABVIEWLENGTH = 0x18; const OFFSETLENGTHSTRINGIMPL = 0x04; const OFFSETHTMLELEMENTREFCOUNT = 0x14; const LENGTHARRAYBUFFER = 0x8; const LENGTHSTRINGIMPL = 0x14; const LENGTHJSVIEW = 0x20; const...

SourceCodester Online Examination System Cross-Site Scripting Vulnerability (CNVD-2020-74075)

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. in the United States. SourceCodester Online Examination System 1.0 suffers from a cross-site scripting vulnerability that originates in the w parameter of index.php, which can be exploited by an...

CVE-2020-29258

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the w parameter to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the w parameter to index.php...

CVE-2020-29258: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Online Examination System 1.0 via the w parameter to index.php...

PT-2020-17127

Name of the Vulnerable Software and Affected Versions Online Examination System version 1.0 Description The issue is a cross-site scripting XSS vulnerability. It can be exploited via the w parameter to the "index.php" endpoint. This allows for potential malicious script injection and execution...

SourceCodester Online Examination System 跨站脚本漏洞

SourceCodester Online Examination System is an online examination system from SourceCodester, Inc. in the United States. SourceCodester Online Examination System 1.0 suffers from a cross-site scripting vulnerability that originates in the w parameter of index.php, which can be exploited by an...

XSS Vulnerability in SG-6000-W, a Next-Generation Firewall from Shanshi Netcom

SG-6000-W is a firewall product with intrusion prevention technology based on deep application, protocol detection and attack principle analysis. A stored XSS vulnerability exists in the SG-6000-W, which can be exploited by an attacker to obtain an administrator cookie...

Siemens SCALANCE W 1750D

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SCALANCE W 1750D Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code...