CSZ CMS 1.3.0 Remote Command Execution

Exploit Title: CSZ CMS Version 1.3.0 Remote Command Execution Date: 17/11/2023 Exploit Author: tmrswrr Vendor Homepage: https://www.cszcms.com/ Software Link: https://www.cszcms.com/link/3https://sourceforge.net/projects/cszcms/files/latest/download Version: Version 1.3.0 Tested on:...

NULL Pointer Dereference

Overview Selenium.WebDriver is a .NET bindings for the Selenium WebDriver API Affected versions of this package are vulnerable to NULL Pointer Dereference due to an insufficient check on CookieWndProc function. An attacker can cause the application to crash by sending specially crafted data that...

WordPress My Login Theme 2FA Brute Force Exploit

The theme my login plugin before 1.2 does not check how often a 2FA code was wrongly entered, allowing a bruteforce of codes to bypass 2FA effectively. A working python exploit: from typing import KeysView from selenium.webdriver.common.by import By from selenium import webdriver from...

Authorization Bypass

firefox and thunderbird are vulnerable to Authorization Bypasses. This vulnerability occurs when Firefox parses a specially crafted WebDriver command. If the command is valid, Firefox could execute arbitrary JavaScript code in the context of the current web page. This could be used to steal the...

SUSE CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

Mozilla Firefox Access Control Error Vulnerability (CNVD-2023-03068)

Mozilla Firefox is an open source Web browser from the Mozilla Foundation in the U.S. An access control error vulnerability exists in Mozilla Firefox, which stems from the Remote Agent used in WebDriver not validating the Host or Origin header. An attacker could exploit the vulnerability to force...

CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

Default configuration

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

CVE-2022-22757

CVE-2022-22757 concerns Mozilla Firefox and involves the Remote Agent used in WebDriver not validating the Host or Origin headers. This could allow a website to connect back locally to the user's browser to take control, specifically when WebDriver is enabled (not the default). Affected products ...

CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

CVE-2022-22757: Origin Validation Error

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

CVE-2022-22757

Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user's browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability affect...

GekkoDriver security vulnerability

geckodriver is an application program. It provides an HTTP API described by the WebDriver protocol to communicate with the Gecko browser. A security vulnerability exists in geckodriver versions prior to 0.30.0, which stems from improved host header checking to reject requests that are not sent to...

com.redhat.darcy:darcy-webdriver (0.3.2), jp.vmi:selenese-runner-java (2.3.0) potentially affected by CVE-2022-28108 via org.seleniumhq.selenium:selenium-server (2.50.0)

org.seleniumhq.selenium:selenium-server MAVEN version 2.50.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.seleniumhq.selenium:selenium-server and may be impacted: - com.redhat.darcy:darcy-webdriver 0.3.2 - jp.vmi:selenese-runner-java 2.3.0 Sourc...

arjuna (>=1.1.15, <=1.2.24), behave-webdriver (0.3.1) +7 more potentially affected by CVE-2022-28108 via selenium (>=4.0.0a1, <=4.0.0rc3)

selenium PYPI version =4.0.0a1, =1.1.15, =1.1.0, =0.1.10, =1.1.0, =0.1.1, =1.0.3, =1.1.1, =1.3.1 Source cves: CVE-2022-28108 Source advisory: OSV:PYSEC-2022-43167...

CVE-2022-28109

Selenium Selenium Grid formerly Selenium Standalone Server Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code remote. The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a...