CVE-2021-20785

Cross-site scripting vulnerability in GroupSession GroupSession Free edition from ver2.2.0 to the version prior to ver5.1.0, GroupSession byCloud from ver3.0.3 to the version prior to ver5.1.0, and GroupSession ZION from ver3.0.3 to the version prior to ver5.1.0 allows a remote attacker to inject...

CVE-2021-37403

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet user-generated content when a sharing link is created and an App Loader relative URL is used...

MuWire 跨站脚本漏洞

MuWire is an open source file publishing and networking tool that uses 12P technology to protect the identity of its users.A security vulnerability in the desktop client prior to MuWire version 0.8.8 could be exploited by an attacker to send a message with a subject line containing a URL tagged...

USN-5006-2 php5, php7.0 vulnerabilities

USN-5006-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that PHP incorrectly handled certain PHAR files. A remote attacker could possibly use this issue to cause PHP to...

EasyApache 输入验证错误漏洞

PHP is a scripting language that executes on the server side. PHP suffers from an input validation error vulnerability that can be exploited by an attacker to spoof a user via PHP's FILTERVALIDATEURL in order to redirect them to a malicious site...

Apache Traffic Server 环境问题漏洞

An environmental issue vulnerability exists in Apache Traffic Server ATS, a set of scalable HTTP proxy and caching servers from the Apache Foundation, which stems from a failure to properly handle URL data segments. An attacker could exploit this vulnerability to affect the cache of the target...

GHSA-8VFW-V2JV-9HWC Reflected cross-site scripting in development mode handler in Vaadin

URL encoding error in development mode handler in com.vaadin:flow-server versions 2.0.0 through 2.6.1 Vaadin 14.0.0 through 14.6.1, 3.0.0 through 6.0.9 Vaadin 15.0.0 through 19.0.8 allows local user to execute arbitrary JavaScript code by opening crafted URL in browser. -...

Umbraco 输入验证错误漏洞

Umbraco CMS is an open source content management system CMS based on ASP.NET technology. An open redirect vulnerability exists in Umbraco CMS versions prior to 7.15.7. The vulnerability stems from insufficient url validation in booting.aspx. No detailed vulnerability details are available at this...

CVE-2021-3314

Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for...

PT-2021-10200 · Gnuboard5 · Gnuboard5

Name of the Vulnerable Software and Affected Versions: gnuboard5 versions prior to 5.3.2.8 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It can be exploited via the url parameter to "bbs/login.php" endpoint. Recommendations: For versions prior to 5.3.2.8, update t...

Avaya Aura Experience Portal 输入验证错误漏洞

Avaya Aura Experience Portal is the next generation of Avaya Voice Portal from Avaya, Inc. providing organizations with a single point of orchestration for all automated voice and multimedia applications and services. experience Portal supports SIP, IP, TDM or hybrid environments. It includes...

Unexpected URL matching with 'MergeSlashes OFF'

...

PT-2021-18013

Name of the Vulnerable Software and Affected Versions: SafeNet KeySecure Management Console version 8.12.0 Description: The issue allows a remote attacker to exploit the vulnerability using a specially-crafted URL to cause the server to return a split response once the URL is clicked. This is...

KuaiFan 参数注入漏洞

KuaiFanCMS later referred to as KF using PHP5 + MYSQL as the technical basis for the development of KF using the Smarty template engine to build a site system. KuaiFanCMS V5 has a security vulnerability, the vulnerability stems from KuaiFanCMS V5 in chakanhtml.module.php file HTML url parameter...

Bosch IP cameras 输入验证错误漏洞

Bosch IP cameras is a German Bosch web camera. Bosch IP cameras is vulnerable to an input validation error that could be exploited by an attacker to inject arbitrary HTTP request headers via a crafted URL...

Bosch IP cameras 跨站脚本漏洞

Bosch IP cameras is a German webcam device.A cross-site scripting vulnerability exists in Bosch IP cameras URL handling, which could be exploited by attackers to inject malicious script or HTML code that could capture sensitive information or hijack user sessions when malicious data is viewed...

CVE-2021-3529

A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary...

VulnCheck KEV: CVE-2021-22991

The Traffic Management Microkernel of BIG-IP ASM Risk Engine has a buffer overflow vulnerability, leading to a bypassing of URL-based access controls...

maltrail

This is a Python-based malicious traffic detection system called Maltrail. It is designed to identify and block malicious traffic by utilizing publicly available blacklists and custom user-defined lists. The system can be used to detect various types of malicious activity, including malware,...

CVE-2021-32052

In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 with Python 3.9.5+, URLValidator does not prohibit newlines and tabs unless the URLField form field is used. If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffecte...