1326 matches found
Cross site scripting
An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Reflected Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /vam/vamanagraphic.php, /vam/vamvamuser.php, /common/vampmain.php...
CVE-2018-14705 Lack of Authentication/Authorization on Administrative Web Pages
In Drobo 5N2 4.0.5, all optional applications lack any form of authentication/authorization validation. As a result, any user capable of accessing the device over the network may interact with and control these applications. This not only poses a severe risk to the availability of these...
Huawei EulerOS: Security Advisory for nginx (EulerOS-SA-2020-1119)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Google Chrome cross-origin data leakage vulnerability (CNVD-2020-10256)
Chrome is a web browsing tool developed by Google. A cross-origin data leakage vulnerability exists in Google Chrome versions prior to 80.0.3987.87. The vulnerability stems from insufficient policy enforcement in Blink in Chrome. An attacker can exploit the vulnerability to leak cross-origin data...
Google Chrome Integer Overflow Vulnerability (CNVD-2020-10249)
Chrome is a web browsing tool developed by Google. An integer overflow vulnerability exists in JavaScript in versions prior to Google Chrome 80.0.3987.87. An attacker can exploit this vulnerability to cause heap corruption via specially crafted HTML pages...
FockCache - Minimalized Test Cache Poisoning
FockCache - Minimalized Test Cache Poisoning Detail For Cache Poisoning : https://portswigger.net/research/practical-web-cache-poisoning FockCache FockCache tries to make cache poisoning by trying X-Forwarded-Host and X-Forwarded-Scheme headers on web pages. After successful result, it gives you ...
Gener8: Clickjacking to change email address
Summary Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of the...
Apache CXF Cross-Site Scripting Vulnerability (CNVD-2020-04127)
Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. Apache CXF cross-site scripting vulnerability. An attacker can exploit this vulnerabili...
CVE-2020-5853
In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict...
Cross site scripting
Symantec Endpoint Detection and Response SEDR, prior to 4.3.0, may be susceptible to a cross site scripting XSS issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially...
CVE-2019-20372
NGINX before 1.17.7, with certain errorpage configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer. Mitigation To mitigate this issue, use a named location instead ...
VulnCheck KEV: CVE-2016-1555
Multiple NETGEAR Wireless Access Point devices allows unauthenticated web pages to pass form input directly to the command-line interface. Exploitation allows for arbitrary code execution...
[SECURITY] Fedora 31 Update: php-7.3.13-1.fc31
PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...
The vulnerability of the Windows GDI component in Windows operating systems allows attackers to disclose protected information.
The vulnerability of the Windows GDI component in Windows operating systems is related to deficiencies in security mechanisms. Exploiting this vulnerability can allow an attacker to disclose sensitive information through a specially crafted web page or file...
Google Chrome JavaScript Buffer Overflow Vulnerability
Google Chrome is the United States Google Google company's a Web browser. JavaScript is one of the JavaScript code debugging components. A buffer overflow vulnerability exists in Google Chrome JavaScript. An attacker can exploit this vulnerability to cause heap corruption with the help of special...
Google Chrome Type Obfuscation Vulnerability (CNVD-2019-46422)
Google Chrome is the United States Google Google company's a Web browser. JavaScript is one of the JavaScript code debugging components. A type confusion vulnerability exists in Google Chrome. An attacker can exploit this vulnerability to cause heap corruption with the help of specially crafted...
Google Chrome JavaScript Component Buffer Overflow Vulnerability
Google Chrome is the United States Google Google company's a Web browser. JavaScript is one of the JavaScript code debugging components. A buffer overflow vulnerability exists in the Google Chrome JavaScript component. An attacker can exploit this vulnerability to execute arbitrary code inside a...
Google Chrome Input Validation Error Vulnerability (CNVD-2019-46759)
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an input validation error vulnerability. An attacker can exploit this vulnerability to spoof domain names with the help of specially crafted HTML pages...
The vulnerability of the DirectWrite programming interface in Windows operating systems allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the DirectWrite programming interface in Windows operating systems is related to errors in object handling in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially crafted document or web page...