CVE-2021-28966

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir...

Code injection

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir...

CVE-2021-28966

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir...

IBM QRadar User Behavior Analytics 跨站请求伪造漏洞

IBM QRadar User Behavior Analytics UBA is a user behavior analysis software from IBM, USA. User activity can be analyzed to detect suspicious insiders and determine if user credentials have been stolen. Security analysts can easily view at-risk users, examine their anomalous activity, and drill...

Discourse 2.7.7 Security Update

A new Discourse update includes two security fixes. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse";...

Hitachi ABB Power Grids eSOMS

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Low attack complexity Vendor: Hitachi ABB Power Grids Equipment: eSOMS Vulnerability: Insufficiently Protected Credentials 2. RISK EVALUATION Successful exploitation of this vulnerability could allow access to user credentials that are stored by the...

Check MK < 1.6.0p25, 2.0.x < 2.0.0p4 XSS Vulnerability

Check MK is prone to a cross-site scripting XSS vulnerability in the management web console. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CP...

CVE-2021-28966

In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir...

Cross-site Scripting (XSS) - Reflected in dolibarr/dolibarr

Description Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off of a web application to the victim's browser. The script is activated through a link, which sends a request to a website with a vulnerability that enables execution of malicious...

Cross-Site Request Forgery (CSRF) in kestasjk/webdiplomacy

✍️ Description csrf bug to change user profile 🕵️‍♂️ Proof of Concept I see there no csrf token checking when updating user-profile save bellow html code in html file and host this file . Now sent this file link to vicitm when victim open the link then his profile information will be changed...

WordPress Simple Post 1.1 Plugin - (Text field) Stored Cross-Site Scripting Vulnerability

Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting XSS Exploit Author: Vikas Srivastava Software Link: https://wordpress.org/plugins/simple-post/ Version: 1.1 Category: Web Application Tested on Mac How to Reproduce this Vulnerability: 1. Install WordPress...

WordPress Simple Post 1.1 Cross Site Scripting

Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting XSS Date: 23/07/2021 Exploit Author: Vikas Srivastava Software Link: https://wordpress.org/plugins/simple-post/ Version: 1.1 Category: Web Application Tested on Mac How to Reproduce this Vulnerability: 1...

WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting (XSS)

Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting XSS Date: 23/07/2021 Exploit Author: Vikas Srivastava Software Link: https://wordpress.org/plugins/simple-post/ Version: 1.1 Category: Web Application Tested on Mac How to Reproduce this Vulnerability: 1...

CVE-2020-7389

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

Command injection

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

Cross site scripting

Sage X3 Stored XSS Vulnerability on ‘Edit’ Page of User Profile. An authenticated user can pass XSS strings the "First Name," "Last Name," and "Email Address" fields of this web application component. Updates are available for on-premises versions of Version 12 components shipped with Syracuse...

CVE-2020-7389

Sage X3 CVE-2020-7389 is a Command Injection vulnerability in the CHAINE Variable Script path. An authenticated user with developer access can pass OS commands through this variable used by the web application; this developer configuration should not be deployed in production. The connected sourc...

CVE-2020-7389 Sage X3 Syracuse Missing Authentication for Critical Function in Developer Environment

Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note, this developer configuration should not be deployed in production...

Sage Group Sage X3 跨站脚本漏洞

Sage Group Sage X3 is an application from Sage Group, Inc. an enterprise resource planning ERP product developed for mature organizations. A cross-site scripting vulnerability exists in Sage X3, which allows an authenticated user to pass the "First Name", "Last Name", and "Email Address" fields o...

Combodo iTop 跨站请求伪造漏洞

Combodo iTop is a set of open source web applications developed by Combodo France based on ITIL and used for daily operations in IT environments. The application provides event management, configuration management and issue management. iTop versions prior to Combodo 2.7.4 are vulnerable to...