PVS - CVAD Setup Wizard - Unable to create Azure targets devices, BDM upload fails

From the Citrix Provisioning Console, using Citrix Virtual desktop wizard from the , target device creation progresses until the stage "Uploading BDM VHD file to azure" , where it fails. PVS Error Failed to Upload BDM Disk to Azure. Error:System.AggregateException: One or more errors occurred. --...

CVE-2024-43006

A stored cross-site scripting XSS vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/askedit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. Whe...

CVE-2022-3399

The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cookienoticeoptionsrefusecodehead' parameter in versions up to, and including, 2.4.17.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2022-3399

The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cookienoticeoptionsrefusecodehead' parameter in versions up to, and including, 2.4.17.1 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.4.17.1 - Authenticated (Admin+) Stored Cross-Site Scripting vulnerability

Authenticated Admin+ Stored Cross-Site Scripting vulnerability discovered by c3p0d4y in WordPress Plugin Cookie Notice & Compliance for GDPR / CCPA versions = 2.4.17.1...

WordPress Cookie Notice & Compliance for GDPR / CCPA Plugin <= 2.4.17.1 is vulnerable to Cross Site Scripting (XSS)

Software Cookie Notice & Compliance for GDPR / CCPA Type Plugin Vulnerable versions = 2.4.17.1 Fixed in 2.4.18 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-3399 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1b0453de5cdc...

PT-2024-30095 · Wishnet · Wishnet Nepstech Wifi Router Ntpl-Xpon1Gfevn

Name of the Vulnerable Software and Affected Versions: wishnet Nepstech Wifi Router NTPL-XPON1GFEVN version 1.0 Description: An issue in the wishnet Nepstech Wifi Router allows a remote attacker to obtain sensitive information via the cookie's parameter. Recommendations: For wishnet Nepstech Wifi...

ROS-20240816-10

A vulnerability in the PHP programming language interpreter is related to the erroneous handling of cookies due to the replacement of spaces, dots, and open square brackets with underscores. as a result of replacing spaces, periods and open square brackets with underscores. Exploitation...

ROS-20240816-15

A vulnerability in the PHP programming language interpreter is related to the erroneous handling of cookies due to the replacement of spaces, dots, and open square brackets with underscores. as a result of replacing spaces, periods and open square brackets with underscores. Exploitation...

PT-2024-37370 · Rockwell Automation · Datamosaix

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: An improper authentication issue exists, allowing a malicious user to generate cookies for any user ID without a username or password. This could enable the malicious user to take...

mod_auth_openidc:2.3 security update

cjose modauthopenidc 2.4.9.4-6 - Resolves: RHEL-36492 Race condition in modauthopenidc filecache - Resolves: RHEL-25421 modauthopenidc: DoS when using OIDCSessionType client-cookie and manipulating cookies CVE-2024-24814...

mod_auth_openidc: DoS when using `OIDCSessionType client-cookie` and manipulating cookies

A flaw was found in modauthopenidc, an OpenID Certified™ authentication and authorization module for the Apache HTTP server. Missing input validation in the modauthopenidcsessionchunks cookie value can make the server vulnerable to a denial of service attack. This issue may allow a remote attacke...

Microsoft Dynamics 365 安全漏洞

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. The product includes financial management, production management and business intelligence management. A cross-site scripting vulnerability exists in Microsoft Dynamics 365 on-premises,...

Exploit for Cross-site Scripting in Wondercms

PoC exploit for CVE-2023-41425, a Wonder CMS RCE XSS vulnerabi...

Mozilla Firefox for iOS cross-site scripting vulnerability (CNVD-2024-36717)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox for iOS suffers from a cross-site scripting vulnerability that is caused due to prolonged pressing of download links. An attacker can exploit this vulnerability to steal the victim's...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to obtain sensitive information due to Node.js undici ( CVE-2023-45143 )

Summary Node.js undici is used by IBM Cloud Pak for Data as part of the . CVE-2023-45143. Vulnerability Details CVEID:CVE-2023-45143 DESCRIPTION: Node.js undici module could allow a remote authenticated attacker to obtain sensitive information, caused by the failure to clear cookie header on...

EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2024-2093)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for...

Malicious code in gdpr-cookie-consent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4b030241c0f342d263d8d7bb420da387e10189d78cc0201bb34cd2ac047d6764 The OpenSSF Package Analysis project identified 'gdpr-cookie-consent' @ 3.0.6 npm as malicious. It is considered malicious because: - The packag...

MAL-2024-7903 Malicious code in gdpr-cookie-consent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4b030241c0f342d263d8d7bb420da387e10189d78cc0201bb34cd2ac047d6764 The OpenSSF Package Analysis project identified 'gdpr-cookie-consent' @ 3.0.6 npm as malicious. It is considered malicious because: - The packag...

CVE-2024-33986

Cross-Site Scripting XSS vulnerability in School Attendance Monitoring System and School Event Management System affecting version 1.0. An attacker could create a specially crafted URL and send it to a victim to obtain details of their session cookie via the 'View' parameter in...