RHEL 6 : python-django (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - python-django: DNS rebinding vulnerability when 'DEBUG=True' CVE-2016-9014 - Django 1.10 before 1.10.7, 1...

RHEL 8 : golang (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - golang: crypto/elliptic: incorrect operations on the P-224 curve CVE-2021-3114 - golang: html/template:...

CVE-2024-4424

The CemiPark software is vulnerable to a stored cross-site scripting (XSS) attack due to improper validation of user-entered data. Attackers can smuggle HTML/JavaScript code into the system, which then executes within the browser space of other users. This issue specifically affects CemiPark vers...

ROS-20240503-06

Vulnerability in the GLPI request and incident handling system related to incorrect input neutralization during web page creation. during the creation of a web page. Exploitation of the vulnerability could allow an attacker acting remotely, perform an XSS attack...

Fedora 40 : gh (2023-684eb03db0)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-684eb03db0 advisory. Automatic update for gh-2.33.0-1.fc40. Changelog Wed Aug 23 2023 Mikel Olasagasti Uranga - 2.33.0-1 - Update to 2.33.0 - Closes rhbz2233559 rhbz2229593 Tenab...

Fedora 40 : rclone (2023-ff1e594f3d)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ff1e594f3d advisory. Automatic update for rclone-1.64.0-1.fc40. Changelog Thu Oct 12 2023 Mikel Olasagasti Uranga - 1.64.0-1 - Update to 1.64.0 - Closes rhbz2238581...

Fedora 40 : xq (2024-e9ca3462aa)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e9ca3462aa advisory. Automatic update for xq-1.2.4-2.fc40. Changelog Sun Feb 11 2024 Maxwell G - 1.2.4-2 - Rebuild for golang 1.22.0 Sun Feb 11 2024 Mikel Olasagasti...

Fedora 40 : caddy (2023-57b1499122)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-57b1499122 advisory. Automatic update for caddy-2.7.4-1.fc40. Changelog Thu Aug 17 2023 Carl George - 2.7.4-1 - Update to version 2.7.4, resolves rhbz2232696 - Fix CVE-2023-3978,...

CVE-2023-20248

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient input validation by the...

CVE-2024-29217 Apache Answer: XSS vulnerability when changing personal website

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer.This issue affects Apache Answer: before 1.3.0. XSS attack when user changes personal website. A logged-in user, when modifying their personal website, can input malicious code in the...

PT-2024-21797 · WordPress · Otter Blocks

Name of the Vulnerable Software and Affected Versions: Otter Blocks WordPress plugin versions prior to 2.6.6 Description: The issue arises from the Otter Blocks WordPress plugin not properly escaping its mainHeadings blocks' attribute before appending it to the final rendered block. This allows...

PT-2024-23688 · Fudforum · Fudforum

Name of the Vulnerable Software and Affected Versions: FUDforum version 3.1.3 Description: A reflected cross-site scripting XSS issue was discovered in FUDforum. The vulnerability is exploited via the chpos parameter at the "/adm/admsmiley.php" API endpoint. Recommendations: For FUDforum version...

CVE-2023-47123

iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an XSS attack can be performed when this object will displayed as an n:n relation item in another object. This vulnerability is fixed in 3.1.1 and 3.2.0...

CVE-2023-47626 iTop vulnerable to XSS vulnerability in authent-token

iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible. This vulnerability is fixed in 3.1.1...

CVE-2023-47123

CVE-2023-47123 concerns iTop, an IT service management platform. The vulnerability arises when an attacker injects malicious code into an object’s friendlyname/complementary name, enabling an XSS attack when that object is rendered as an n:n relation item in another object. Affected behavior is l...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

CHAOS RAT 5.0.1 Remote Command Execution

Exploit Title: CHAOS RAT v5.0.1 RCE Date: 2024-04-05 Exploit Author: @chebuya Software Link: https://github.com/tiagorlampert/CHAOS Version: v5.0.1 Tested on: Ubuntu 20.04 LTS CVE: CVE-2024-30850, CVE-2024-31839 Description: The CHAOS RAT web panel is vulnerable to command injection, which can be...

CVE-2024-20367

A vulnerability in the web UI of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker...

CVE-2024-20367

A vulnerability in the web UI of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker...