CVE-2021-30180

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary...

IBM Engineering Test Management 跨站脚本漏洞

IBM Engineering Test Management is a collaborative quality management solution that provides end-to-end test planning and test asset management with broad coverage from requirements to defects. A cross-site scripting vulnerability exists in IBM Engineering Test Management version 7.0.0, 7.0.1. An...

CVE-2019-12348

An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter...

CVE-2021-24280

In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the importfromdebug AJAX action to inject PHP objects...

Knowage 跨站脚本漏洞

Knowage is an open source suite for modern business analytics on traditional resources and big data systems from Knowage Italy. A cross-site scripting vulnerability exists in Knowage Suite version 7.3. An attacker can inject arbitrary web scripts via the "nota" parameter...

EUVD-2021-18809

Microsoft Accessibility Insights for Web Information Disclosure Vulnerability...

NoneCMS 跨站脚本漏洞

NoneCMS is a simple and compact open-source content management system that can be used to quickly build corporate sites, personal blogs, and support mobile. A cross-site scripting vulnerability exists in admin/article/add.html in NoneCMS version 1.3.0. Attackers can use the name parameter to inje...

Centreon Web Cross-Site Request Forgery Vulnerability

Centreon Web is a set of open source system monitoring tools from the French company Centreon . The product mainly provides monitoring functions on the network , system and application resources . A cross-site request forgery vulnerability exists in Centreon-Web in Centreon Platform version 20.10...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to smuggle malicious JavaScript without the --unsafe option through HTML entities. PoC link Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...

TYPO3 Dynamic Content Element SQL注入漏洞

TYPO3 Dynamic Content Element is a mobile application from the Swiss company TYPO3. TYPO3 Dynamic Content Element has a SQL injection vulnerability, which stems from insufficient filtering of user-supplied data and can be exploited by attackers to inject SQL to obtain data-sensitive information...

CVE-2021-2152

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware component: Analytics Web General. Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows high privileged attacker...

Glovo: Moodle XSS on evolve.glovoapp.com

Cross Site Scripting XSS / Moodle XSS Summary : Cross-site scripting XSS is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by...

Apache Tapestry 代码问题漏洞

Apache Tapestry is the United States Apache Apache Foundation of a Web application framework written in the Java language . Apache Tapestry has a security vulnerability that can be exploited by an attacker to download the file "AppModule.class" by requesting the URL "http: localhost: 8080 assets...

CVE-2021-0275

A Cross-site Scripting XSS vulnerability in J-Web on Juniper Networks Junos OS allows an attacker to target another user's session thereby gaining access to the users session. The other user session must be active for the attack to succeed. Once successful, the attacker has the same privileges as...

MDaemon Technologies WorldClient 跨站脚本漏洞

MDaemon Webmail is an application from MDaemon Inc. A cross-site scripting vulnerability exists in MDaemon Webmail versions prior to 20.0.4, which can be exploited to perform any action with the privileges of the attacked user via a GET request...

HTMLy 跨站脚本漏洞

HTMLy is a PHP-based open source blogging platform. A cross-site scripting vulnerability exists in htmly 2.8.0, which originates from config.html.php...

CVE-2020-15942

An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile...

Information disclosure

An information disclosure vulnerability in Web Vulnerability Scan profile of Fortinet's FortiWeb version 6.2.x below 6.2.4 and version 6.3.x below 6.3.5 may allow a remote authenticated attacker to read the password used by the FortiWeb scanner to access the device defined in the scan profile...

WordPress 插件 代码问题漏洞

WordPress Plugin is an open source application plugin for WordPress. The WordPress Facebook for WordPress plugin has a security vulnerability prior to version 3.0.0, which can be exploited by attackers to achieve remote code execution via the available magic methods...

Vulnerability fixed in FortiWeb

A vulnerability has been fixed in FortiWeb. An authenticated malicious party could exploit the vulnerability to obtain plaintext passwords for systems configured via a Web Vulnerability Scan profile. FortiNet has released updates to fix the vulnerability in FortiWeb. For more information, see:...