711 matches found
CVE-2022-26156
An issue was discovered in the web application in Cherwell Service Management CSM 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places...
Librenms 跨站脚本漏洞
Librenms is a PHP and MySQL based open source network monitoring system from the Librenms community. The system features custom alerts, auto-discovery of network environments and automatic updates.Librenms suffers from a cross-site scripting vulnerability that stems from the lack of proper...
The vulnerability of the web application of D-Link DIR-X1860 microprogramming software allows a hacker to send hidden HTTP requests (HTTP Request Smuggling attack).
The vulnerability of the web application developed with microprogramming software for D-Link DIR-X1860 is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests HTTP Request Smuggling attack using specially created...
livehelperchat 跨站脚本漏洞
livehelperchat is available through Live Helper Chat, which provides free live support on the website. livehelperchat 3.93v previously had a cross-site scripting vulnerability that stemmed from the lack of proper validation of client-side data by the WEB application, which could be exploited by a...
PHPGurukul Dairy Farm Shop Management System 信任管理问题漏洞
Dairy Farm Shop Management System is a PHP and MySQL based dairy farm management system . A hard-coded vulnerability exists in the Dairy Farm Shop Management System, which stems from hard-coded credentials in the code that can be exploited by an attacker to access the control panel...
D-Link Dir-X1860 环境问题漏洞
The D-Link Dir-X1860 is a dual-band router from D-Link, a Chinese company. The D-Link DIR-X1860 suffers from a denial-of-service vulnerability that stems from the lack of HTTP packet authentication and filtering in the software web application leading to HTTP smuggling attacks, which can be...
Directory traversal
Directory traversal in /northstar/Common/NorthFileManager/fileManagerObjects.jsp Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to browse and list the directories across the entire filesystem of the host of the web application...
SPIP 跨站请求伪造漏洞
SPIP is a Web-based content publishing system. A cross-site request forgery vulnerability exists in SPIP, which stems from a Web application that does not adequately validate that requests are coming from trusted users. An attacker could use this vulnerability to send unintended requests to the...
webmail.planalservicos.com.br Cross Site Scripting vulnerability OBB-2341609
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
scratch-svg-renderer 跨站脚本漏洞
scratch-svg-renderer is a code library used by the Scratch team to convert SVG to DOM elements. scratch-Svg-Renderer suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications, which can be exploited to execute client-si...
CVE-2021-36450
Verint Workforce Optimization WFO 15.2.8.10048 allows XSS via the control/mynotifications NEWUINAV parameter...
PT-2021-4851 · Cisco · Cisco Common Services Platform Collector
Name of the Vulnerable Software and Affected Versions: Cisco Common Services Platform Collector CSPC affected versions not specified Description: A vulnerability in the web application of Cisco Common Services Platform Collector could allow an authenticated, remote attacker to specify non-log fil...
PHPCMS SQL注入漏洞
PHPCMS is a web content management system based on PHP and Mysql architecture. The system includes modules for news, images, downloads, information, products, and more. PHPCMS suffers from a SQL injection vulnerability, which originates from the lack of validation of externally entered SQL...
The vulnerability of the Redmine project and task management web application, related to the lack of protective measures for the website structure, allows attackers to compromise the integrity of the data.
The vulnerability of web applications for project and task management is related to the lack of protective measures for the website’s structure. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the data...
Ingeteam Ingepac Da Au 信息泄露漏洞
Ingeteam Ingepac Da Au is an affordable solution from Ingeteam. for complete measurement and detection of fault bypasses anywhere in the grid. A security vulnerability exists in the Ingeteam INGEPAC DA AU AUC1.13.0.28 and earlier web application that allows access to specific paths containing...
Alfresco 跨站脚本漏洞
Alfresco is an open source enterprise content management system. The platform page using Freemarker development , the main features include document management , collaboration , records management , knowledge base management , Web content management and so on. Alfresco has a security vulnerabilit...
IBM QRadar Advisor with Watson 跨站脚本漏洞
IBM QRadar Advisor with Watson is a suite of security threat analysis solutions from IBM USA. The product includes features such as security threat response and threat probing. A security vulnerability exists in IBM QRadar Advisor with Watson, which stems from the lack of proper validation of...
Ibm Security Risk Manager on Cp4S 安全漏洞
Ibm Security Risk Manager on Cp4S is a security risk manager from Ibm USA. A security vulnerability exists in Ibm Security Risk Manager on Cp4S, which stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute...
Trane Tracer SC 跨站脚本漏洞
Trane Tracer SC is an intelligent field panel from Trane Australia that communicates with unit controllers LON or BACnet to provide independent control of HVAC equipment. A cross-site scripting vulnerability exists in Trane Tracer SC. The vulnerability stems from a lack of proper validation of...