Plone 跨站脚本漏洞

Plone is an open source content management system CMS built on the Zope application server. Plone suffers from a cross-site scripting vulnerability in versions 5.0 through 5.2.4 that stems from the fact that if a contributor creates a folder with a SCRIPT tag in the description field, the editor ...

WordPress plugin Smart Slider 'name' cross-site scripting vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A cross-site scripting vulnerability exists in the WordPress plugin Smart Slider 'name',...

IBM Datacap Fastdoc Capture 跨站脚本漏洞

IBM Datacap Fastdoc Capture is a client-only capture software solution from IBM USA that automatically indexes scanned documents for accurate storage and retrieval. A cross-site scripting vulnerability exists in IBM Datacap Fastdoc Capture that stems from a lack of proper validation of client-sid...

Design/Logic Flaw

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with...

CVE-2021-29481 Client side sessions should not allow unencrypted storage

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with...

Ratpack 安全特征问题漏洞

Ratpack is a Java library for building scalable HTTP applications. A security vulnerability exists in Ratpack versions prior to 1.9.0, which stems from the client-side session module defaulting to using the application startup time as the signing key, and can be exploited by an attacker to tamper...

ECShop 跨站脚本漏洞

ECShop is an open source mall system for business school . Support PC + H5 + APP + small program mall, source code free download experience, suitable for enterprise development and build mall. There is a cross-site scripting vulnerability in ECShop, which originates from the lack of security...

Acronis: CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis Cloud

Summary Hi team, I hope everything goes well. I have found a CSS Injection in Acronis Cloud Management Consolehttps://mc-beta-cloud.acronis.com/mc via the colorscheme GET parameter. Description: The flow work as I will comment below. If we go to the URL...

Shopware 跨站脚本漏洞

Shopware is an open source e-commerce platform. A cross-site scripting vulnerability exists in Shopware versions prior to 5.6.10. An attacker can exploit this vulnerability to inject malicious script into Administration to execute client-side code...

SUSE Manager和SUSE Linux Enterprise Server 授权问题漏洞

SUSE Manager and SUSE Linux Enterprise Server are both products of SUSE, Germany.SUSE Manager is a Linux server management system. SUSE Manager is a Linux server management system that provides automated software management, system configuration, and monitoring.SUSE Linux Enterprise Server is an...

The vulnerability of the client-side loading mechanism of the McAfee TechCheck performance scanning system allows a perpetrator to execute arbitrary code.

The vulnerability of the PC performance scanning system’s McAfee TechCheck lies in the loading of a non-existent dynamic library. Exploiting this vulnerability allows an attacker to execute arbitrary code...

Cross site scripting

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

CVE-2010-4264

It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side...

Design/Logic Flaw

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user even unauthenticated to add unlimited like/dislike to any comment. The plugin appears to have som...

CVE-2021-24379 Comments Like Dislike < 1.1.4 - Add Like/Dislike Bypass

The Comments Like Dislike WordPress plugin before 1.1.4 allows users to like/dislike posted comments, however does not prevent them from replaying the AJAX request to add a like. This allows any user even unauthenticated to add unlimited like/dislike to any comment. The plugin appears to have som...

Trace Financial CRESTBridge Cross-Site Scripting Vulnerability (CNVD-2021-61763)

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial CRESTBridge, which can be exploited by attackers to execute client-side code...

Trace Financial Crest Bridge Cross-Site Scripting Vulnerability

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial Crest Bridge, which can be exploited by attackers to execute client-side code...

Google Workspace Now Offers Client-side Encryption For Drive and Docs

Google on Monday announced that it's rolling out client-side encryption to Google Workspace formerly G Suite, thereby giving its enterprise customers direct control of encryption keys and the identity service they choose to access those keys. "With client-side encryption, customer data is...

Backdoor.Win32.Zombam.gen Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/ff6516c881dee555b0cd253408b64404.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Zombam.gen Vulnerability: Cross Site Scripting XSS Description: Zombam malware listen...

Trace Financial Crest Bridge 跨站脚本漏洞

CRESTBridge is a resilient, feature-rich interface for Trace Financial.A cross-site scripting vulnerability exists in Trace Financial Crest Bridge, which can be exploited by attackers to execute client-side code...