Zulip 代码问题漏洞

Zulip is a powerful open source group chat application from the Zulip team. Used to combine the immediacy of real-time chat with the productivity benefits of threaded conversations, Zulip suffers from a code issue vulnerability that stems from improper design or implementation during the code...

Lark Technologies: Full read SSRF via Lark Docs `import as docs` feature

A SSRF server side request forgery vulnerability was found in the LarkDocs using the "import as docs" feature, which could have potentially been used to access services running on the internal network. We thank @sirleeroyjenkins for reporting this to our team and confirming the resolution...

CVE-2021-41569

creationtimestamp| type| source ---|---|--- 2021-11-19 20:17:08+00:00| seen| https://t.me/cibsecurity/32718 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-41569.yaml 2024-11-22 00:00:00+00:00| seen| The Shadowserver...

CVE-2021-21700

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...

CVE-2021-21700

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...

CVE-2021-21700

CVE-2021-21700 affects the Jenkins Scriptler Plugin. Documents confirm a stored XSS in Scriptler Plugin versions 3.3 and earlier caused by failing to escape the name of scripts on the UI during deletion confirmation. The vulnerability can be exploited by attackers who can create Scriptler scripts...

CVE-2021-21700

Jenkins Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion, resulting in a stored cross-site scripting XSS vulnerability exploitable by exploitable by attackers able to create Scriptler scripts...

Jenkins 跨站脚本漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.A cross-site scripting vulnerability exists in the Jenkins Plugin, which stems from the Scriptler plugin version 3.3 and...

Stored XSS vulnerability in scriptler

scriptler 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to create Scriptler scripts. scriptler 3.4 escapes the name of scripts on the UI when asking...

Cross-Site Request Forgery (CSRF) in bookstackapp/bookstack

Description Login CSRF via /register/confirm/token endpoint. Proof of Concept 1: Register account with the same username as our victim, an email confirmation will take place 2: Retrieve token from email. 3: Send a link http://BOOKSTACKAPPURL/register/confirm/token to user. 4: When the user clicks...

CVE-2021-42258

creationtimestamp| type| source ---|---|--- 2021-10-23 02:39:32+00:00| exploited| https://t.me/cibsecurity/31084 2021-10-25 22:32:43+00:00| seen| MISP/63ddead6-4b82-414c-ad8e-c516b950b446 2021-10-26 18:55:45+00:00| seen| https://t.me/truesecator/2254 2021-10-27 10:22:02+00:00| exploited|...

CVE-2021-20124

creationtimestamp| type| source ---|---|--- 2021-10-13 20:26:47+00:00| seen| https://t.me/cibsecurity/30518 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-20124.yaml 2024-09-03 18:10:03+00:00| seen|...

Pterodactyl 授权问题漏洞

Pterodactyl is an open source game server administration panel built using PHP, Nodejs and Go. Pterodactyl suffers from a security vulnerability that allows a malicious user to modify the content of the confirmationtoken input during the two-factor authentication process to refer to cached values...

Use of a Broken or Risky Cryptographic Algorithm in anonaddy/anonaddy

Description MD5 and SHA-1 are popular cryptographic hash algorithms often used to verify the integrity of messages and other data. Recent advances in cryptanalysis have discovered weaknesses in both algorithms. Consequently, MD5 and SHA-1 should no longer be relied upon to verify the authenticity...

PT-2021-23112 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl affected versions not specified Description: A malicious user can modify the contents of a confirmation token input during the two-factor authentication process to reference a cache value not associated with the login attempt. Thi...

spakompagniet.dk Cross Site Scripting vulnerability OBB-2150202

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Cross-site Scripting (XSS) - Stored in yogeshojha/rengine

✍️ Description 'Delete Scheduled Task' confirmation model executes javascript as part of the name of a scan engine. 🕵️‍♂️ Proof of Concept 1. Name a scan engine as a XSS payload. Example: 2. Schedule a scan for any target using the created scan engine. 3. Try to delete the scheduled task Location...

CVE-2021-39165

creationtimestamp| type| source ---|---|--- 2021-08-27 00:27:08+00:00| seen| https://t.me/cibsecurity/27932 2021-08-31 13:10:52+00:00| seen| https://t.me/CyberSecurityTechnologies/4194 2022-03-18 06:41:26+00:00| published-proof-of-concept| https://t.me/cKure/9068 2023-05-26 10:28:54+00:00|...

CVE-2021-36792

The datednews aka Dated News extension through 5.1.1 for TYPO3 has incorrect Access Control for confirming various applications...

CVE-2021-36792

The CVE-2021-36792 issue affects the TYPO3 dated_news extension (versions up to 5.1.1). Root cause: incorrect Access Control for confirming various applications. Impact (as described in related sources): attackers could confirm various applications and potentially access all application registrat...