The vulnerability of the Server Name Identification (SNI) component of the Cisco Web Security Appliance internet server, the micro-programming software for Cisco Firepower Threat Defense network firewalls, and the intrusion detection systems allows a malicious actor to gain full control over the compromised host and unauthorized access to protected information.

The vulnerability of the Server Name Identification SNI component of the Cisco Web Security Appliance internet server, as well as the micro-programming software for Cisco Firepower Threat Defense and the intrusion detection system Snort, is related to SSL handshake filtering errors. Exploiting th...

CVE-2021-27822

CVE-2021-27822 affects Vehicle Parking Management System 1.0, with a persistent XSS in the Add Categories module via the Category field. Root cause cited across connected sources as insufficient validation/escape of client-side data, enabling arbitrary script execution. Impact is described as rem...

CVE-2021-34749

A vulnerability in Server Name Identification SNI request filtering of Cisco Web Security Appliance WSA, Cisco Firepower Threat Defense FTD, and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from...

CVE-2021-34749

A vulnerability in Server Name Identification SNI request filtering of Cisco Web Security Appliance WSA, Cisco Firepower Threat Defense FTD, and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from...

CVE-2021-34749

CVE-2021-34749 affects Cisco WSA/FTD and the Snort detection engine. The issue stems from inadequate filtering of the SSL handshake in the SNI data path, allowing an unauthenticated remote attacker to bypass filters and exfiltrate data from a compromised host, potentially enabling command-and-con...

CVE-2021-34749

Removed by vendor...

CVE-2021-34749

A vulnerability in Server Name Identification SNI request filtering of Cisco Web Security Appliance WSA, Cisco Firepower Threat Defense FTD, and the Snort detection engine could allow an unauthenticated, remote attacker to bypass filtering technology on an affected device and exfiltrate data from...

PT-2021-3823 · Cisco · Snort +2

Name of the Vulnerable Software and Affected Versions: Cisco Web Security Appliance affected versions not specified Cisco Firepower Threat Defense affected versions not specified Snort detection engine affected versions not specified Description: A vulnerability in Server Name Identification SNI...

Cross-Site Request Forgery (CSRF) in aces/loris

✍️ Description Attacker able to create admin user with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks...

CVE-2020-20988

DomainMOD 4.13.0 is vulnerable to Cross-Site Scripting through the reporting/domains/cost-by-owner.php endpoint, with the flaw in the "or Expiring Between" parameter. The issue allows an attacker to cause the browser to execute arbitrary JavaScript in the victim’s session (context: DomainMOD 4.13...

CVE-2020-20977

CVE-2020-20977 is a stored cross‑site scripting (XSS) vulnerability in UK CMS v1.1.10, specifically in index.php/legend/6.html, exploitable via a crafted payload placed in the Comments section. Multiple connected sources confirm the affected software and vector (stored XSS through Comments) witho...

CVE-2020-25562

In SapphireIMS 5.0, there is no CSRF token present in the entire application. This can lead to CSRF vulnerabilities in critical application forms like account resent...

CVE-2020-21930

CVE-2020-21930 is a stored XSS in Eyoucms v1.4.1, specifically in the web_attr_2 field. The vulnerability allows authenticated attackers to inject and execute arbitrary web scripts/HTML. The available connected documents consistently identify Eyoucms v1.4.1 as affected, but do not provide explici...

nodejs-ssri: Regular expression DoS (ReDoS) when parsing malicious SRI in strict mode

A flaw was found in ssri package. A malicious string provided by an attacker may lead to Regular Expression Denial of Service ReDoS. This issue only affects consumers using the strict option. The highest threat from this vulnerability is to availability...

Cross site scripting

UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting XSS, which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA...

The vulnerability of Cisco AMP, a security tool against malicious software, for end-user devices running Cisco AsyncOS in Cisco Email Security Appliance and Cisco Web Security Appliance systems is related to the lack of trust-chain tracking during certificate verification. This allows attackers to intercept traffic between affected devices.

The vulnerability of Cisco AMP, a security tool for malicious software, in devices running Cisco AsyncOS, which are part of Cisco Email Security Appliance and Cisco Web Security Appliance systems, stems from the lack of trust-chain tracking during certificate verification. Exploiting this...

OneNav Beta 0.9.12 Cross Site Scripting

Exploit Title: XSS-Stored - Brutal PWNED on OneNav beta 0.9.12 addlink feature Author: nu11secur1ty Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r Date: 08.06.2021 Vendor: https://www.xiaoz.me/ Link: https://github.com/helloxz/onenav/releases/tag/0.9.12 CVE: CVE-2021-38138 + Exploit Source:...

CVE-2020-21357

PopojiCMS 1.2 is affected by a stored XSS in /admin.php?mod=user&act=addnew, exploitable via a crafted payload in the E-Mail field. The vulnerability stems from an input that is stored and later rendered, enabling arbitrary web scripts or HTML execution. Exploitation details are not provided in t...

CVE-2021-36454

Navigate CMS 2.9 is affected by a cross-site scripting (XSS) vulnerability (CVE-2021-36454) exploitable via the navigate-quickse parameter in multiple files (e.g., backups.php, blocks.php, brands.php, comments.php, coupons.php, feeds.php, functions.php, items.php, menus.php, orders.php, payment_m...

CVE-2021-36454

Cross Site Scripting XSS vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1 backups\backups.php, 2 blocks\blocks.php, 3 brands\brands.php, 4 comments\comments.php, 5 coupons\coupons.php, 6 feeds\feeds.php, 7 functions\functions.php, 8 items\items.php, 9...