496 matches found
CVE-2023-39244: Improper Access Control
DELL ESI Enterprise Storage Integrator for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by eavesdropping the network traffic to gain admin level credentials...
CVE-2023-39245: Cleartext Transmission of Sensitive Information
DELL ESI Enterprise Storage Integrator for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. An remote unauthenticated attacker could potentially exploit this vulnerability by eavesdropping the network traffic to gain admin level credentials...
Cross site scripting
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
CVE-2023-4372 LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
CVE-2023-4372: Improper Neutralization of Input During Web Page Generation
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...
PT-2023-28939 · WordPress · Litespeed Cache
Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin for WordPress versions up to, and including, 5.6 Description: The issue is related to Stored Cross-Site Scripting via the esi shortcode due to insufficient input sanitization and output escaping on user-supplied...
Squid DoS Vulnerability (GHSA-wgvf-q977-9xjg, SQUID-2024:3)
Squid is prone to a denial of service DoS vulnerability in ESI processing. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Amazon Linux 2 : squid (ALASSQUID4-2023-010)
The version of squid installed on the remote host is prior to 4.15-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2SQUID4-2023-010 advisory. 2023-10-12: CVE-2022-41317 was added to this advisory. An issue was discovered in Squid through 4.7 and 5. When receivin...
Important: squid
Issue Overview: A flaw was found in Squid through version 4.7. When handling the tag esi:when, when ESI is enabled, Squid calls the ESIExpression::Evaluate function which uses a fixed stack buffer to hold the expression. While processing the expression, there is no check to ensure that the stack...
esi-asia.com Cross Site Scripting vulnerability OBB-3578717
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
esi-france.fr Cross Site Scripting vulnerability OBB-3565669
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
esi-deutschland.de Cross Site Scripting vulnerability OBB-3565668
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Juniper Junos OS Vulnerability (JSA69721)
The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA69721 advisory. - An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an adjacent unauthenticated...
esi-asia.com Cross Site Scripting vulnerability OBB-3319589
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
SUSE CVE-2018-1000024
The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server...
SUSE CVE-2019-12521
An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elemen...
NetChess 2.1 Buffer Overflow Exploit
Exploit Title: NetChess2.1 Buffer Overflow SEH Exploit Author: Ugur Eminli Vendor Homepage: https://sourceforge.net/projects/avmnetchess/ Software Link: https://sourceforge.net/projects/avmnetchess/ Version: 2.1 Tested on: WinXP SP2 Build 2600 !/usr/bin/perl my $file= "exploit.pgn"; my $junk=...
trafficserver:FuzzEsi: Null-dereference READ in EsiParser::_processIncludeTag
Project: https://github.com/apache/trafficserver.git Detailed Report: https://oss-fuzz.com/testcase?key=5979420909502464 Project: trafficserver Fuzzing Engine: honggfuzz Fuzz Target: FuzzEsi Job Type: honggfuzzasantrafficserver Platform Id: linux Crash Type: Null-dereference READ Crash Address:...
CVE-2022-22217
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service DoS. The issue is caused by malformed MLD packets looping on a multi-homed Ethernet Segme...
Design/Logic Flaw
An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS allows an adjacent unauthenticated attacker to cause a Denial of Service DoS. The issue is caused by malformed MLD packets looping on a multi-homed Ethernet Segme...