SPIP content injection vulnerability

SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. A security vulnerability exists in core/plugins/medias in version 3.2.x prior to SPIP 3.2.7. A remote attacker could exploit the vulnerability to inject content into the database...

Semrush: Content Injection on api.semrush.com to Reflected XSS

The researcher found XSS vulnerability and wrote an awesome summary! : While testing api.semrush.com I've found that some inputs triggered MongoDB error on /reports/v1/projects/:id/siteaudit/page/list endpoint. Contents of url parameter was reflected in error message. Unfortunately WAF blocked my...

Ruby has an unspecified vulnerability (CNVD-2020-12798)

Ruby is a simple and fast object-oriented object-oriented programming scripting language. An unspecified vulnerability exists in Ruby. An attacker could exploit the vulnerability by inserting line breaks to split headers and inject malicious content to spoof the client...

CVE-2019-17233

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection...

CVE-2019-17233

The CVE affects WordPress plugin Ultimate FAQ (WordPress) up to version 1.8.24. The vulnerability originates in Functions/EWD_UFAQ_Import.php, allowing unauthenticated HTML content injection during FAQ import, potentially exposing malicious content to site visitors. Exploitation details are not p...

Security Update for .NET Core SDK (Sep 2019)

The Microsoft .NET Core SDK installation on the remote host is version 2.1.x 2.1.509, or 2.1.606 or 2.1.802, 2.2.x 2.2.109 or 2.2.206 or 2.2.302. It is, therefore, affected by multiple vulnerabilities: - A denial of service vulnerability when .Net Core improperly handles web requests. An...

Privilege Escalation

ASP.NET Core is vulnerable to privilege escalation. When an ASP.NET Core web application is created using vulnerable project templates, the application fails to properly sanitize web requests. An attacker is able to exploit the vulnerability by sending an email to the user containing a malicious...

.NET Core SDK Multiple Vulnerabilities (Sep 2019)

ASP.NET Core SDK is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:.netcoresdk";...

.NET Core Multiple Vulnerabilities (Sep 2019)

ASP.NET Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:asp.netcore" ;...

ASP.NET Core Elevation Of Privilege Vulnerability

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests. An attacker who successfully exploited this vulnerability could perform content injection attacks and run script in the security...

Microsoft Exchange Spoofing Vulnerability

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App OWA fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive...

Active Directory Federation Services XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Active Directory Federation Services ADFS does not properly sanitize certain error messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server. The attacker who...

LifterLMS <= 3.34.5 - Unauthenticated Options Import

Unauthenticated Options Import, which could lead to - Website Redirection - Administrator Account Creation - Content Injection - Stored XSS The issues have been reported as fixed in 3.35.0. However v3.35.1 added additional input sanitisation and filtering...

Tenable Nessus < 8.5.0 Multiple Vulnerabilities (TNS-2019-04)

According to its self-reported version, the Tenable Nessus application running on the remote host is prior to 8.5.0. It is, therefore, affected by multiple vulnerabilities: - A reflected XSS vulnerability due to improper validation of user-supplied input. An unauthenticated, remote attacker could...

CVE-2019-0319

The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not...

CVE-2019-0319

The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not...

Session fixation

The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not...

CVE-2019-0319

CVE-2019-0319 affects the SAP Gateway products listed (versions 7.5, 7.51, 7.52, 7.53). The root cause described is input content injection that can be displayed as an error message, enabling an attacker to mislead users into thinking the message is from the legitimate service. The connected docu...

CVE-2019-0319

The SAP Gateway, versions 7.5, 7.51, 7.52 and 7.53, allows an attacker to inject content which is displayed in the form of an error message. An attacker could thus mislead a user to believe this information is from the legitimate service when it's not...

Karenderia CMS 5.1 Content Injection

=========================================================================================== Exploit Title: Karenderia CMS 5.1 - Frame Inj. Dork: N/A Date: 02-07-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage: [email protected] Software Link:...