Apache Tomcat XSS Vulnerabilities in Examples Web Application

Multiple cross-site scripting XSS vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via...

GHSA-HC39-RJWP-QFFQ Apache Tomcat XSS Vulnerabilities in Examples Web Application

Multiple cross-site scripting XSS vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via...

GHSA-5HGM-QM5M-5VMW Jakarta Tomcat cross-site scripting (XSS) vulnerability

Multiple cross-site scripting XSS vulnerabilities in the 1 examples and 2 ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML...

Undetectable Backdoors in Machine-Learning Models

New paper: "Planting Undetectable Backdoors in Machine Learning Models": Abstract: Given the computational cost and technical expertise required to train machine learning models, users may delegate the task of learning to a service provider. We show how a malicious learner can plant an undetectab...

WordPress Popup Maker 1.16.5 Plugin - Stored Cross-Site Scripting (Authenticated) Vulnerability

Exploit Title: WordPress Plugin Popup Maker Popup Settings Triggers Add New Cookie Add Cookie Time overwrite the default '1 month' with XSS payload Click 'Add' what triggers the XSS payload Payload examples: alert'XSS';...

[SECURITY] Fedora 36 Update: osgearth-3.2-7.fc36

osgEarth is a C++ terrain rendering SDK. Just create a simple XML file, point it at your imagery, elevation, and vector data, load it into your favorite OpenSceneGraph application, and go! osgEarth supports all kinds of data and comes with lots of examples to help you get up and running quickly a...

Mageia: Security Advisory (MGASA-2018-0220)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mirai Botnet Abusing Log4j Vulnerability

Threat Researcher Larry Cashdollar has discovered evidence of the Mirai botnet abusing Log4j vulnerability and shares code examples...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

CVE-2021-44228 Helpers Helpers, examples, and exploits for cv...

8x8: 8x8pilot.com: Reflected XSS in Apache Tomcat /jsp-examples example directory

A single host in the pilot environment exposed the Apache Tomcat /jsp-examples example directory. The issue has been rectified, as we removed the directory from the host...

CVE-2021-42228

A Cross Site Request Forgery CSRF vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html...

Cross site scripting

Cross SIte Scripting XSS vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor the file suffix is allowed...

Cross site request forgery (csrf)

A Cross Site Request Forgery CSRF vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html...

CVE-2021-42228

A Cross Site Request Forgery CSRF vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html...

CVE-2021-42227

CVE-2021-42227 describes a cross‑site scripting (XSS) vulnerability in KindEditor 4.1.x . The weakness is triggered via the editor’s upload flow, specifically related to the file handling in the upload context (e.g., an upload_json.php path) and exposure through a Google search result pointing to...

CVE-2021-42228: Cross-Site Request Forgery (CSRF)

A Cross Site Request Forgery CSRF vulnerability exists in KindEditor 4.1.x, as demonstrated by examples/uploadbutton.html...

Exploit for Path Traversal in Microsoft

〖EXP〗Ladon CVE-2021-40444 Office Vulnerability Reimplementatio...

Parameter updates not propagated

Handle gpersoon Vulnerability details Impact There are several functions to update parameters. However these parameters are only updated on the top level and not propagated to the other contracts. This could lead to various unpredictable results. Examples are: setNftHubAddress of RCFactory...

S3-Account-Search - S3 Account Search

This tool lets you find the account id an S3 bucket belongs too. For this to work you need to have at least one of these permissions: Permission to download a known file from the bucket s3:getObject. Permission to list the contents of the bucket s3:ListBucket. Additionally, you will need a role...

Denial of Service (DoS)

Overview transpile is a Transpiles JavaScript modules from one format to another. Affected versions of this package are vulnerable to Denial of Service DoS due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to function. PoC Base code: var transpi...