7785 matches found
Cross site scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting XSS vector in the registerinline.vm template related to the xredirect hidden field. This template is only used in the following conditions:...
GHSA-66GW-CH5V-74V8 Cross-site scripting (XSS) in Apache ActiveMQ
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0...
Cross-site scripting (XSS) in Apache ActiveMQ
An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0...
GHSA-7PH6-5CMQ-XGJQ Path traversal in xwiki-platform-skin-skinx
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with...
CVE-2022-23622 Cross site scripting in registration template in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting XSS vector in the registerinline.vm template related to the xredirect hidden field. This template is only used in the following conditions:...
CVE-2022-23622
XWiki Platform contains an XSS vulnerability (CVE-2022-23622) in the registerinline.vm template associated with the xredirect hidden field. Exploitation requires the wiki to be open to registration and the XWiki.Registration page to be forbidden for guests (or equivalent rights); administrators e...
CVE-2022-23622 Cross site scripting in registration template in xwiki-platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions there is a cross site scripting XSS vector in the registerinline.vm template related to the xredirect hidden field. This template is only used in the following conditions:...
CVE-2021-36302
All Dell EMC Integrated System for Microsoft Azure Stack Hub versions contain a privilege escalation vulnerability. A remote malicious user with standard level JEA credentials may potentially exploit this vulnerability to elevate privileges and take over the system...
Iranian Hackers Using New Marlin Backdoor in 'Out to Sea' Espionage Campaign
An advanced persistent threat APT group with ties to Iran has refreshed its malware toolset to include a new backdoor dubbed Marlin as part of a long-running espionage campaign that started in April 2018. Slovak cybersecurity company ESET attributed the attacks — codenamed "Out to Sea" — to a...
Dell EMC Integrated System 安全漏洞
DELL EMC Integrated System is a native hybrid cloud platform for infrastructure and platform-as-a-service from Dell USA. An elevation of privilege vulnerability exists in Dell EMC Integrated System for Microsoft Azure Stack Hub. The vulnerability stems from an incorrect programmatic call to an...
Wordpress Administration Panel Login Form Bruteforced
The scanner successfully authenticated on the Wordpress administration panel by using weak or predictable credentials. No source data...
Wordpress Plugin All-in-one Floating Contact Form 跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. wordpress Plugin All-in-one Floating Contact Form...
U.S. General Services Administration: IDOR at https://demo.sftool.gov/TwsHome/ScorecardManage/ via scorecard name
Hi Team, I have found a broken access control vulnerability on https://demo.sftool.gov/ under your /tws directory. I made two accounts. One account i browsed to /tws and created a new scorecard. Here i can submit all information I need. The scorecard name is in the end of the URL...
CVE-2021-44881
D-Link device DIR882 DIR882FW1.30B06Hotfix02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request...
[SECURITY] Fedora 35 Update: 389-ds-base-2.0.14-1.fc35
389 Directory Server is an LDAPv3 compliant server. The base package includes the LDAP server and command line utilities for server administration...
D-Link DIR-878 命令注入漏洞
D-Link DIR-878 is a wireless router from D-Link, a Taiwan-based company in China. The D-Link DIR-878 is vulnerable to an operating system command injection vulnerability, which stems from the inclusion of a command injection vulnerability in a system function. An attacker could exploit the...
GitLab Enterprise Edition 和 Community Edition 路径遍历漏洞
GitLab Enterprise Edition is a content management system, and GitLab Community Edition is a community edition of GitLab from GitLab, Inc. A path traversal vulnerability exists in GitLab Enterprise Edition and Community Edition, which stems from the software's lack of effective filtering and...
Korenix Technology JetWave CSRF / Command Injection / Missing Authentication
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Critical Vulnerabilities product: Korenix Technology JetWave products: JetWave 2212X, JetWave 2212S, JetWave 2212G, JetWave 2311, JetWave 3220 vulnerable version...
[SECURITY] Fedora 35 Update: phpMyAdmin-5.1.2-1.fc35
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats and i...
[SECURITY] Fedora 34 Update: phpMyAdmin-5.1.2-1.fc34
phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the Web. Currently it can create and drop databases, create/drop/alter tables, delete/edit/add fields, execute any SQL statement, manage keys on fields, manage privileges,export data into various formats and i...