U.S. Dept Of Defense: RXSS - ████

Hello, friends today when I was checking some sites I found this bug on your own website. Detalis XSS Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web...

Information Exposure

Overview activeresource is a library to wrap your RESTful web app with Ruby classes and work with them like Active Record models. Affected versions of this package are vulnerable to Information Exposure. There is an issue with the way Active Resource encodes data before querying the back end...

CarSpot < 2.2.3 - Multiple Vulnerabilities

Multiple vulnerabilities was discovered in the 'CarSpot – Dealership Wordpress Classified Theme', tested version — v2.2.0: - Authenticated Persistent XSS - Registration Form/User Profile - Authenticated Persistent XSS - Ad Post - IDOR leading to arbitrary deletion of ads Edit WPScanTeam: January...

The vulnerability of the sal_util_str_encrypt() function (libsal.so) in the software for Zyxel routers series GS1900 allows a attacker to disclose protected information.

The vulnerability of the salutilstrencrypt function libsal.so in Zyxel router microsoftware of the GS1900 series exists due to the rigid encoding of registration data. Exploiting this vulnerability can allow a remote attacker to disclose the protected information...

Cross site scripting

The events-manager plugin through 5.9.5 for WordPress aka Events Manager is susceptible to Stored XSS due to improper encoding and insertion of data provided to the attribute mapstyle of shortcodes locationsmap and eventsmap provided by the plugin...

CVE-2019-13266

TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds wi...

CVE-2019-13263

D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK...

Design/Logic Flaw

Edimax BR-6208AC V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK...

CVE-2019-13263

D-Link DIR-825AC G1 (and related DIR-882 family) devices are affected by insufficient isolation between host and guest networks. The vulnerability arises when a DHCP Request with a Transaction ID causes the router to reply with an ACK/NAK, and the NAK can be sent to both Host and Guest networks u...

The vulnerability of the coTURN server function, related to an error in the encoding of registration data, allows a hacker to gain access to the server under the authority of the administrator.

The vulnerability of the coTURN server function is related to an error in the encoding of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the server through the telnet port under the authority of the administrator...

What stealthy attacks are hiding in API data — and why do most WAF miss them?!

What stealthy attacks are hiding in API data — and why do most WAF miss them?! API Data: What is it and how is it saying it? APIs are the blood flow of today’s applications — from online browser-based apps to mobile apps to sophisticated distributed enterprise applications connecting dozens of...

Flask is vulnerable to Denial of Service via incorrect encoding of JSON data

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

PYSEC-2018-66

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

UBUNTU-CVE-2018-1000656

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. Th...

The vulnerability of the Alphanetworks account service allows a hacker to gain root access, enabling them to gain control over the D-Link DIR-850L router’s microprogramming software.

The vulnerability of the Alphanetworks account registration service, a microprogramming-based router operating system from D-Link, DIR-850L, lies in the rigid encoding of registration data during device reboots. Exploiting this vulnerability could allow an attacker, operating remotely, to gain ro...

The vulnerability of the software for managing devices in the OnCell Central Manager allows a hacker to gain administrator privileges.

The vulnerability of the login function in the RequestController class of the software tool for managing devices in the OnCell Central Manager network is related to the rigid encoding of registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain...

The vulnerability of the NX-OS network operating system allows a hacker to gain superuser privileges.

The vulnerability of the NX-OS network operating system exists due to the rigid encoding of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain superuser privileges through TELNET or SSH sessions...

The vulnerability of the Signage Station presentation preparation program and the iArtist Lite presentation preparation utility, which allows a intruder to access protected information

The vulnerability of the Signage Station presentation preparation service and the iArtist Lite presentation preparation utility exists due to the rigid encoding of registration data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to protected informatio...

The vulnerability of the microprogramming software of the Telemetry Gateway allows a intruder to gain administrator privileges.

The vulnerability of the Microprogrammed Software of the Telemetry Gateway exists due to the rigid encoding of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrator privileges...

The vulnerability of microprogrammed software in programmable logic controllers PCD allows a intruder to gain administrator privileges.

The vulnerability of PCD programmable logic controllers’ microprogramming software exists due to the rigid encoding of registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain administrator privileges through an FTP session...