372 matches found
cashIT Code Injection Vulnerability
cashIT is an old cell phone recycling website by cashIT India. cashIT suffers from a code injection vulnerability that originates from the ability to execute remote code via an HTTP endpoint exposed to the network...
CVE-2023-40592
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...
CVE-2023-40592 Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...
CVE-2023-40592 Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...
PT-2023-27971 · Tenda · Tenda Ac9 +1
Name of the Vulnerable Software and Affected Versions: Tenda AC9 version V15.03.06.42 multi Tenda AC5 version V15.03.06.28 Description: A stack overflow issue was discovered via the parameter list at the "/goform/SetStaticRouteCfg" API endpoint. This issue affects the specified versions of Tenda...
PT-2023-9332 · Unknown +5 · Alertmanager +5
Name of the Vulnerable Software and Affected Versions: Alertmanager versions prior to 0.2.51 Description: The issue is related to the improper neutralization of input data during web page generation in the /api/v1/alerts endpoint of the Alertmanager component in the Prometheus monitoring system. ...
PT-2023-4795 · Splunk · Splunk Enterprise
Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.1.1 Splunk Enterprise versions prior to 9.0.6 Splunk Enterprise versions prior to 8.2.12 Description: The issue is related to a reflected cross-site scripting XSS vulnerability in the Splunk Enterprise...
PT-2023-14300 · Gx · Xperiencentral
Name of the Vulnerable Software and Affected Versions: GX Software XperienCentral versions 10.36.0 and earlier Description: The issue allows unauthorized users to post data to the server by sending POST requests to the /web/mvc endpoint if they can bypass other security filters. Recommendations:...
PT-2023-26196 · Macstadium +1 · Jenkins Orka By Macstadium Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Orka by MacStadium Plugin versions 1.33 and earlier Description: A missing permission check in the Jenkins Orka by MacStadium Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using...
CVE-2021-25828
Emby Server versions 4.6.0.50 is vulnerable to Cross Site Scripting XSS vulnerability via a crafted GET request to /web...
CVE-2021-25828
Emby Server versions 4.6.0.50 is vulnerable to Cross Site Scripting XSS vulnerability via a crafted GET request to /web...
PT-2023-12079 · Emby · Emby Server
Name of the Vulnerable Software and Affected Versions: Emby Server versions prior to 4.6.0.50 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via a crafted GET request to the "/web" API endpoint. Recommendations: For Emby Server versions prior to...
PT-2025-51744
Name of the Vulnerable Software and Affected Versions D-Link DAP-1325 firmware version 1.01 Description The device has a flaw in access control that permits unauthenticated attackers to obtain device configuration settings without needing to authenticate. Attackers can access the...
CVE-2023-35147
Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not restrict the AWS SQS queue name path parameter in an HTTP endpoint, allowing attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system...
PT-2023-25166 · Jenkins · Jenkins Aws Codecommit Trigger Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins AWS CodeCommit Trigger Plugin versions 3.0.12 and earlier Description: The issue allows attackers with Item/Read permission to obtain the contents of arbitrary files on the Jenkins controller file system due to the lack of restriction...
PT-2023-23418 · Wcms · Wcms
Name of the Vulnerable Software and Affected Versions: Wcms version 0.3.2 Description: The issue allows an attacker to send a crafted request from a vulnerable web application backend server via the "finish" parameter and the textAreaCode parameter in the "/wcms/wex/html.php" endpoint. This enabl...
CVE-2023-30529
Jenkins Lucene-Search Plugin 387.v938aecbf7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reindex the database...
PT-2023-22757 · Jenkins · Jenkins Lucene-Search Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Lucene-Search Plugin versions 387.v938a ecb f7fe9 and earlier Description: The issue allows attackers to reindex the database due to the lack of requirement for POST requests for an HTTP endpoint, resulting in a cross-site request...
Jenkins 安全漏洞
Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins version 2.393 and earlier, LTS version 2.375.3 and earlier. An attacker could...
PT-2023-20761 · Abus · Abus Tvip 20000-21150
Name of the Vulnerable Software and Affected Versions: ABUS TVIP 20000-21150 devices Description: The issue allows remote attackers to execute arbitrary code via shell metacharacters in the "/cgi-bin/mft/wireless mft" ap field. This enables attackers to potentially gain control over the device...