150566 matches found
Automattic: Open redirect via redirect_to parameter in tumblr.com
The Tumblr website was affected by an open redirect vulnerability that allowed an attacker to redirect users to a specified URL through the "redirectto" parameter. This vulnerability could have been exploited to conduct phishing attacks or distribute malware...
Researchers Uncover Python Package Targeting Crypto Wallets with Malicious Code
Cybersecurity researchers have discovered a new malicious Python package that masquerades as a cryptocurrency trading tool but harbors functionality designed to steal sensitive data and drain assets from victims' crypto wallets. The package, named "CryptoAITools," is said to have been distributed...
PT-2024-9697
Name of the Vulnerable Software and Affected Versions: CyberPanel versions prior to 2.3.8 Description: The issue exists due to the lack of measures to neutralize special elements, allowing a remote attacker to execute arbitrary commands using a specially crafted HTTP OPTIONS request. This can be...
The vulnerability of the Digital Platform “ForSight. Analytical Platform” arises from the lack of measures taken to protect the website structure, allowing attackers to carry out XSS attacks.
The vulnerability of the “Forrest. Analytical Platform” digital platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...
CVE-2024-7985: Unrestricted Upload of File with Dangerous Type
The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the "fileorganizerajaxhandler" function in all versions up to, and including, 1.0.9. This makes it possible for authenticated attackers, with...
The vulnerability of the HikCentral Master Lite software for video surveillance and security systems lies in the lack of protective measures for website structures, allowing attackers to carry out cross-site scripting attacks.
The vulnerability of the HikCentral Master Lite video surveillance and security management software is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
The vulnerability of the LAquis SCADA data collection and process control tool, related to the lack of protective measures for the website structure, allows attackers to perform cross-site scripting attacks.
The vulnerability of the LAquis SCADA data collection and process control tool is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
The vulnerability of the jQuery UI JavaScript library, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks.
The vulnerability of the jQuery UI JavaScript library is related to the lack of protective measures for website structures. Exploiting this vulnerability could allow attackers to execute cross-site scripting attacks...
Coder vulnerable to post-auth URL redirection to untrusted site ('Open Redirect')
Summary An issue on Coder's login page allows attackers to craft a Coder URL that when clicked by a logged in user could redirect them to a website the attacker controls, e.g. https://google.com. Details On the login page, Coder checks for the presence of a redirect query parameter. On successful...
Bad Bots: 6 Common Bot Attacks and Why They Happen
Learn about the different types of bot attacks, why they happen, and how to protect your website from these threats with effective bot mitigation strategies...
CVE-2024-47158
N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary code may be executed on the instructor's browser, or the instructor may be directed to a malicious website...
CVE-2024-47158
The CVE-2024-47158 vulnerability affects N-LINE 2.0.6 and earlier, where improper input validation (CWE-94) allows code injection that can execute arbitrary code in the instructor’s browser or redirect to a malicious site. Public sources (JVN/NVD) indicate the issue affects N-LINE 2.0.6 and prior...
CVE-2024-47158
N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary code may be executed on the instructor's browser, or the instructor may be directed to a malicious website...
CVE-2024-47158
N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary code may be executed on the instructor's browser, or the instructor may be directed to a malicious website...
The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.
The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
CVE-2024-47879
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...
CVE-2024-47879 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, lack of cross-site request forgery protection on the preview-expression command means that visiting a malicious website could cause an attacker-controlled expression to be executed. The expression can...
CVE-2024-46995
baserCMS is a website development framework. Versions prior to 5.1.2 have a cross-site scripting vulnerability in HTTP 400 Bad Request. Version 5.1.2 fixes this issue...