4012 matches found
Citrix Releases Security Updates for Application Delivery Management
Citrix has released security updates to address vulnerabilities in Application Delivery Management. An attacker could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review Citrix Security Update CTX460016 and apply the necessary...
Food-order-and-table-reservation-system SQL Injection Vulnerability
Food-order-and-table-reservation-system is enabling users to order food online and reserve a table for dine-in if there is no delivery option. food-order-and-table-reservation-system version 1.0 is vulnerable to an SQL injection vulnerability that originates in the categorywise-menu.php page wher...
Windows Firewall Notification When Connecting to VDA 2112 and newer
This article explains why users may receive a Windows Firewall popup when connecting to a resource running Virtual Delivery Agent 2112 and newer...
WinDealer dealing on the side
Introduction LuoYu is a lesser-known threat actor that has been active since 2008. It primarily goes after targets located in China, such as foreign diplomatic organizations established in the country, members of the academic community, or companies from the defense, logistics and...
WordPress Flower Delivery by Florist One plugin <= 3.5.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress Flower Delivery by Florist One plugin versions = 3.5.15. Solution No fixed version is available...
OS Command Injection
Description A OS Command Injection in rancher continuous delivery panel, add repository function Proof of Concept first install a rancher in docker and login. Go to continuous delivery panel and click add repository button.\ set repository url as --upload-pack=$touch /tmp/poc, and click Create...
Integer overflow
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a...
CVE-2022-31005 Integer Overflow in Vapor's HTTP Range Request
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a...
CVE-2022-31005 Integer Overflow in Vapor's HTTP Range Request
Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerability that can crash the application. Version 4.60.3 contains a patch for this issue. As a workaround, disable FileMiddleware and serve via a...
If you get an email saying “Item stopped due to unpaid customs fee”, it’s a fake
Our spam traps recently caught a phishing scam that neatly illustrates some of the tactics scammers use routinely to avoid both human intuition, and automatic detection. The scam starts with an unsolicited email, of course… The scam email is ostensibly from the Post Office, an instantly...
多款Citrix Systems产品资源管理错误漏洞
Citrix Systems Citrix Gateway Citrix Systems NetScaler Gateway and Citrix ADC are both products of Citrix Systems, Inc.Citrix Gateway is a secure remote access solution. The product provides administrators with application-level and data-level controls to enable users to remotely access...
Glovo: Exposed valid AWS, Mysql, Sendgrid and other secrets
Summary: Hi team, I just discovered some hardcoded credentials allowing access to AWS, Mysql database, ... To make this report short, here is the POC: see ███ & █████ Steps To Reproduce: where there are the info : APPNAME=Glovo APPENV=local APPKEY=█████ APPDEBUG=false APPURL=http://localhost...
GHSA-MFR9-PCM3-6MWC phpMyAdmin CSRF Vulnerability
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potential...
GoCD Cross-Site Scripting Vulnerability (CNVD-2022-77809)
ThoughtWorks GoCD is a continuous delivery server. versions 20.2.0 through 21.4.0 of ThoughtWorks GoCD contain a cross-site scripting vulnerability that stems from a vulnerability to reflected cross-site scripting via an abusive function that renders arbitrary HTML into the returned page. An...
GoCD Cross-Site Scripting Vulnerability
GoCD is a continuous delivery server. A cross-site scripting vulnerability exists in GoCD versions 19.11.0 through 21.4.0, which could be exploited by attackers to obtain a GoCD user's session cookie and execute malicious code...
CVE-2022-29184 Command Injection/Argument Injection in GoCD
GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on the GoCD server via configuring a...
CVE-2022-29184
GoCD vulnerability (CVE-2022-29184) : In GoCD versions prior to 22.1.0, authenticated admins who can edit or create pipeline materials or configuration repositories can trigger remote code execution on the GoCD server by configuring a malicious branch name that abuses Mercurial hooks/aliases duri...
CVE-2022-29183
CVE-2022-29183 affects ThoughtWorks GoCD (versions 20.2.0–21.4.0). A reflected cross-site scripting vulnerability stems from the pipeline comparison function’s error handling, allowing an attacker to render arbitrary HTML in the returned page and potentially manipulate resources accessible to the...
CVE-2022-29182
GoCD versions 19.11.0–21.4.0 are vulnerable to a DOM-based XSS in the Stage Details > Graphs tab. An attacker-hosted page can abuse the messaging channel between the parent page and the stage-graphs iframe to execute script in the user’s browser context, potentially exfiltrating session cookie...
CVE-2022-29182 DOM-based XSS in GoCD
GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 inclusive are vulnerable to a Document Object Model DOM-based cross-site scripting attack via a pipeline run's Stage Details Graphs tab. It is possible for a malicious script on a attacker-hosted site to execute script tha...