U.S. Dept Of Defense: Time-based blind SQL injection

A time-based blind SQL injection vulnerability was discovered in the sortBy parameter of the web application's SearchDocs.aspx functionality. The vulnerability was identified by observing differences in the server's response time when specific payloads were used. This type of vulnerability could...

The vulnerability of the Next.js software platform for creating web applications lies in its ability to bypass authentication by using a user-controlled key. This allows attackers to disclose sensitive information that should be protected.

The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a non-dynamic cache from the server...

The vulnerability of the web application for managing rental housing, the Campcodes House Rental System, arises from the lack of measures to protect the SQL query structure. This allows attackers to execute arbitrary SQL queries.

The vulnerability of the web application for managing rental housing, Campcodes House Rental System, is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Building Your First Web Application with Yii Framework

Did you know that over 80% of web applications fail due to poor planning and execution? Now imagine…...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the version control feature due to improper user input sanitization. An attacker can manipulate the output of the page by injecting malicious scripts through a malformed URL. Details Cross-site scripting...

Synology DiskStation Manager Credentials Management Errors (CVE-2010-3684)

The FTP authentication module in Synology Disk Station 2.x logs passwords to the web application interface in cases of incorrect login attempts, which allows local users to obtain sensitive information by reading a log, a different vulnerability than CVE-2010-2453. This plugin only works with...

CVE-2024-28811

An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations...

GHSA-62R2-GCXR-426X starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

Summary A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. Details Here's the offending line:...

CVE-2024-8457

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack...

CVE-2024-9329

In Eclipse Glassfish versions before 7.0.17, The Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is '/management/domain'. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal...

CVE-2024-8458

Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery CSRF. An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such...

CVE-2024-8457

Certain switch models from PLANET Technology have a web application that does not properly validate specific parameters, allowing remote authenticated users with administrator privileges to inject arbitrary JavaScript, leading to Stored XSS attack...

CVE-2024-8458 PLANET Technology switch devices - Cross-site Request Forgery

Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery CSRF. An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such...

CVE-2024-8458

The CVE-2024-8458 entry concerns PLANET Technology switch models whose web interface is vulnerable to Cross-Site Request Forgery (CSRF). Affected component: the web application on certain PLANET switch devices. Root cause: CSRF in the web front end allows an unauthenticated remote attacker to tri...

CVE-2024-8458 PLANET Technology switch devices - Cross-site Request Forgery

Certain switch models from PLANET Technology have a web application that is vulnerable to Cross-Site Request Forgery CSRF. An unauthenticated remote attacker can trick a user into visiting a malicious website, allowing the attacker to impersonate the user and perform actions on their behalf, such...

CVE-2024-8457

PLANET Technology switch devices are affected by a Stored XSS vulnerability in the web management interface. The issue arises from improper validation of certain web parameters, enabling a remote attacker with administrator privileges to inject arbitrary JavaScript. The vulnerability specifically...

CVE-2024-9329

CVE-2024-9329 affects Eclipse GlassFish prior to 7.0.17. The Host HTTP parameter at the /management/domain endpoint can cause the web application to redirect to an attacker‑controlled URL, enabling phishing and potential credential theft. The reports indicate an Open Redirect risk tied to this pa...

PLANET switch devices 跨站请求伪造漏洞

PLANET switch devices are a series of switch devices from PLANET Corporation in China. The PLANET switch devices suffer from a cross-site request forgery vulnerability, which arises from the vulnerability of a web application to a cross-site request forgery attack, where an attacker can trick a...

PT-2024-22584 · Infinera · Infinera Hit 7300

Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: A web application in the Infinera hiT 7300 allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations. This issue can lead to unauthoriz...

CVE-2024-28811

An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute applications contained in a specific OS directory via HTTP invocations...