Cross-site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2021-59156)

NETGEAR JNR1010 and others are a wireless router from NETGEAR USA. A cross-site request forgery vulnerability exists in multiple NETGEAR products. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could use the...

QRadar Community Edition 7.3.1.6 Server Side Request Forgery Vulnerability

QRadar Community Edition version 7.3.1.6 has an issue where the RssFeedItem class of the QRadar web application is used to fetch and parse RSS feeds. No validation is performed on the user-supplied RSS feed URL. Due to the lack of URL validation whitelisting, it is possible for authenticated...

QRadar Community Edition 7.3.1.6 Cross Site Scripting Vulnerability

QRadar Community Edition version 7.3.1.6 suffers from a reflective cross site scripting vulnerability in the Forensics link analysis page. ------------------------------------------------------------------------ Reflected Cross-Site Scripting in QRadar Forensics link analysis page...

QRadar Community Edition 7.3.1.6 Authorization Bypass Vulnerability

Exploit for php platform in category web applications ------------------------------------------------------------------------ Authorization bypass in QRadar Forensics web application ------------------------------------------------------------------------ Abstract...

NETGEAR ReadyNAS OS Cross-Site Request Forgery Vulnerability

NETGEAR ReadyNAS OS is a set of operating systems for ReadyNAS network-attached storage devices from NETGEAR. A cross-site request forgery vulnerability exists in NETGEAR ReadyNAS OS 6 using firmware versions prior to 6.9.3. The vulnerability stems from a WEB application that does not adequately...

Air Sender 1.0.2 Arbitrary File Upload

Document Title: =============== Air Sender v1.0.2 iOS - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2212 Release Date: ============= 2020-04-24 Common Vulnerability Scoring System:...

python-twisted: HTTP request smuggling when presented with two Content-Length headers

A flaw was found in python-twisted-web, where it does not correctly process HTTP requests, accepting requests with more than one Content-Length header. When the requests sent from and to the python-twisted-web are processed by another component that correctly processes HTTP requests, for example,...

Cross-Site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2020-31321)

The NETGEAR R7500, among others, is a wireless router from NETGEAR. A cross-site request forgery vulnerability exists in a number of NETGEAR products. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a trusted user, and can be exploite...

User Management System 2.0 Cross Site Scripting

Exploit Title: User Management System 2.0 - Persistent Cross-Site Scripting Author: Besim ALTINOK Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/user-registration-login-and-user-management-system-with-admin-panel/ Version: v2.0 Tested on: Xampp Credit: İsmail BOZKU...

Sky File 2.1.0 iOS - Directory Traversal Vulnerability

Exploit for php platform in category web applications Title: Sky File 2.1.0 iOS - Directory Traversal Date: 2020-04-21 Software Link: https://apps.apple.com/us/app/sky-file-wireless-transfer/id1236452210 CVE: N/A Document Title: =============== Sky File v2.1.0 iOS - Multiple Web Vulnerabilities...

Cross-site scripting vulnerability in multiple NETGEAR products (CNVD-2020-31238)

NETGEAR D6200 and others are products of NETGEAR Corporation.NETGEAR D6200 is a wireless modem.NETGEAR WNR2020 is a wireless router.NETGEAR R6220 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is ...

Sky File 2.1.0 iOS - Directory Traversal

Title: Sky File 2.1.0 iOS - Directory Traversal Author: Vulnerability Laboratory Date: 2020-04-21 Software Link: https://apps.apple.com/us/app/sky-file-wireless-transfer/id1236452210 CVE: N/A Document Title: =============== Sky File v2.1.0 iOS - Multiple Web Vulnerabilities References Source:...

JetBrains Space Chats Cross-Site Scripting Vulnerability

JetBrains Space is a team collaboration solution from the Czech company JetBrains. The product supports online chat, online meetings, code review and package repository, etc. Chats is one of the online chat components. A cross-site scripting vulnerability exists in Chats in JetBrains Space versio...

jQuery cross-site scripting vulnerability (CNVD-2021-28726)

jQuery is a set of open source , cross-browser JavaScript library . The library simplifies the operation between HTML and JavaScript , and has a modular , plug-in extensions and other features . A cross-site scripting vulnerability exists in jQuery version 2.2.2. The vulnerability stems from a la...

Air Sender v1.0.2 iOS - Arbitrary File Upload Vulnerability

Document Title: =============== Air Sender v1.0.2 iOS - Arbitrary File Upload Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2212 Release Date: ============= 2020-04-23 Vulnerability Laboratory ID VL-ID: ==================================...

Cross-site scripting vulnerability in multiple NETGEAR products (CNVD-2020-31240)

NETGEAR WNR3500L and others are products of NETGEAR.WNR3500L is a wireless router.NETGEAR R6400 is a wireless router.NETGEAR D6200 is a wireless modem.NETGEAR R6400 is a wireless router.NETGEAR R6400 is a wireless router.NETGEAR R6400 is a wireless router.NETGEAR R6400 is a wireless router.NETGEA...

Cross-site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2021-59162)

NETGEAR WAC505 and others are a wireless access point AP from NETGEAR, Inc. A cross-site request forgery vulnerability exists in several NETGEAR products. The vulnerability stems from the WEB application not adequately verifying that the request is from a trusted user. An attacker could use the...

Cross-Site Request Forgery Vulnerability in Multiple NETGEAR Products (CNVD-2021-59165)

NETGEAR D7000 and others are products of NETGEAR Corporation.NETGEAR D7000 is a wireless modem.NETGEAR WNR2020 is a wireless router.NETGEAR R6220 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is a wireless router.NETGEAR WNR2020 is ...

NETGEAR ReadyNAS OS xss Vulnerability (CNVD-2020-74064)

NETGEAR ReadyNAS OS is a set of operating systems for ReadyNAS network attached storage devices from NETGEAR. A cross-site scripting vulnerability exists in NETGEAR ReadyNAS OS 6 versions prior to 6.8.0. The vulnerability stems from a lack of proper validation of client data by the WEB applicatio...

NETGEAR R6700v2 and R6800 Cross-Site Scripting Vulnerability

The NETGEAR R6700v2 and NETGEAR R6800 are both a wireless router from NETGEAR. A cross-site scripting vulnerability exists in the NETGEAR R6700v2 prior to version 1.1.0.42 and the R6800 prior to version 1.1.0.42. The vulnerability stems from a lack of proper validation of client data by the WEB...