1639 matches found
CVE-2022-36112: Server-Side Request Forgery (SSRF)
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests ca...
GLPI 代码问题漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...
Check additional fields returned by latestRoundData to ensure price data is not stale/incorrect
Lines of code Vulnerability details Impact Not checking additional fields returned by Chainlink might cause incorrect prices being processed. Proof of Concept The only values being check from latestRoundData are price and updatedAt. File: src/modules/PRICE.sol 161: , int256 ohmEthPriceInt, ,...
Stored XSS vulnerability when importing RSS Feeds from external source
Description YetiForceCRM allows user create RSS Feeds without purifying the link field of the input data properly from external source. An attacker can take advantage of this vulnerability to perform an XML Injection attack that leads to stored cross-site scripting XSS on the target server. Proof...
WordPress Social Slider Feed plugin <= 2.0.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability via Feeds discovered by WPScan in WordPress Social Slider Feed plugin versions = 2.0.6. Solution Update the WordPress Social Slider Feed plugin to the latest available version at least 2.0.7...
Social Slider Feed < 2.0.7 - Admin+ Stored XSS via Feeds
The plugin does not sanitise as well as escape user input in feeds, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in a Instagram...
Social Slider Feed < 2.0.7 - Admin+ Stored XSS via Feeds
The plugin does not sanitise as well as escape user input in feeds, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in a Instagram Fee...
CVE-2022-34865
In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support EoTS are...
CVE-2022-34865
In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support EoTS are...
CVE-2022-34865 Traffic intelligence feeds vulnerability CVE-2022-34865
In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support EoTS are...
CVE-2022-34865: Improper Certificate Validation
In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support EoTS are...
CVE-2022-34865
In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic Intelligence feeds, which use HTTPS, do not verify the remote endpoint identity, allowing for potential data poisoning. Note: Software versions which have reached End of Technical Support EoTS are...
F5 BIG-IP Traffic Intelligence Feeds Certificate Validation Error Vulnerability
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A certificate validation error vulnerability exists in F5 BIG-IP Traffic Intelligence Feeds, which can be exploited by...
F5 BIG-IP 信任管理问题漏洞
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A certificate validation error vulnerability exists in F5 BIG-IP Traffic Intelligence Feeds, which can be exploited by...
F5 Networks BIG-IP : Traffic Intelligence feeds vulnerability (K25046752)
The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.5 / 15.1.6.1 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K25046752 advisory. - In BIG-IP Versions 15.1.x before 15.1.6.1, 14.1.x before 14.1.5, and all versions of 13.1.x, Traffic...
Social Slider Feed < 2.0.5 - Subscriber+ Stored XSS via Feeds
The plugin does not have authorisation and CSRF check in place when adding and editing a Feed, and does not sanitise as well as escape user input. As a result, users with a role as low as subscriber could add arbitrary feeds, with Stored Cross-Site Scripting payloads in them. As any authenticated...
Social Slider Feed < 2.0.5 - Subscriber+ Stored XSS via Feeds
The plugin does not have authorisation and CSRF check in place when adding and editing a Feed, and does not sanitise as well as escape user input. As a result, users with a role as low as subscriber could add arbitrary feeds, with Stored Cross-Site Scripting payloads in them. PoC As any...
WordPress Social Slider Feed plugin <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability via Feeds discovered by WPScan in WordPress Social Slider Feed plugin versions = 2.0.4. Solution Update the WordPress Social Slider Feed plugin to the latest available version at least 2.0.5...
