Design/Logic Flaw

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs...

CVE-2023-37256

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs...

AWS data.all 代码注入漏洞

AWS data.all is an open source development framework open sourced by awslabs. A code injection vulnerability exists in AWS data.all versions 1.2.0 through 1.5.1, which stems from a code injection vulnerability that allows an authenticated attacker to inject Python commands into Template fields wh...

protobuf-java: Message-Type Extensions parsing issue leads to DoS

A flaw was found in Message-Type Extensions in protobuf-java core that can lead to a denial of service. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields can cause objects to convert between mutable and immutable forms, resulting in long garbag...

Meldekarten Generator 跨站脚本漏洞

Meldekarten Generator is a project to create a program by the individual developer jucktnich. A cross-site scripting vulnerability exists in Meldekarten generator 1.0.0b1.1.1 and earlier versions, which stems from the vulnerability of all text fields on a web page to an XSS attack, where user inp...

The vulnerability of the Fields plugin in the GLPI request and incident management system allows a hacker to write data into any field, including those for which he does not have access.

The vulnerability of the Fields plugin in the GLPI request and incident management system is related to the lack of access control checks. Exploiting this vulnerability allows an attacker to write data into any fields, including those for which they do not have authorized access...

msLDAPDump - LDAP Enumeration Tool

msLDAPDump simplifies LDAP enumeration in a domain environment by wrapping the lpap3 library from Python in an easy-to-use interface. Like most of my tools, this one works best on Windows. If using Unix, the tool will not resolve hostnames that are not accessible via eth0 currently. Binding...

FortiNAC - argument injection in XML interface on port tcp/5555

An improper neutralization of special elements used in a command 'command injection' vulnerability CWE-77 in FortiNAC tcp/5555 service may allow an unauthenticated attacker to copy local files of the device to other local directories of the device via specially crafted input fields. To access the...

Internet Bug Bounty: HTTP Request Smuggling via Empty headers separated by CR

The llhttp parser in the Node.js http module did not strictly use the CRLF sequence to delimit HTTP requests, which allowed for HTTP Request Smuggling HRS. This vulnerability affected all active versions of Node.js...

CVE-2023-33213

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in gVectors Display Custom Fields – wpView plugin = 1.3.0 versions...

CVE-2023-33213

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in gVectors Display Custom Fields – wpView plugin = 1.3.0 versions...

CVE-2023-33213

CVE-2023-33213 concerns the WordPress plugin Display Custom Fields – wpView . Affected software: wpView plugin versions up to and including 1.3.0. The vulnerability is a Stored Cross-Site Scripting (XSS) issue, with exploitation requiring Administrator privileges. The connected documents provide ...

CVE-2023-33213 WordPress wpView Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in gVectors Display Custom Fields – wpView plugin = 1.3.0 versions...

WordPress Plugin gVectors Display Custom Fields–wpView 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-7992 · Zabbix +2 · Zabbix +2

Name of the Vulnerable Software and Affected Versions: Zabbix affected versions not specified Description: The issue is related to reflected XSS attacks, which occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form...

The vulnerability of FTP servers of microprogrammed logic controllers MELSEC RJ71EIP91, SW1DNN-EIPCT-BD, FX5-ENET/IP, SW1DNN-EIPCTFX5-BD allows a intruder to gain unauthorized access to protected information.

The vulnerability of FTP servers of microprogrammed logic controllers such as MELSEC RJ71EIP91, SW1DNN-EIPCT-BD, FX5-ENET/IP, and SW1DNN-EIPCTFX5-BD lies in the insufficient protection of password input fields. Exploiting this vulnerability can allow attackers to gain unauthorized access to...

GHSA-8F6X-V685-G2XC Apache Struts vulnerable to memory exhaustion

Denial of service via out of memory OOM owing to not properly checking of list bounds. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to OOM if developer has set struts.multipart.maxSize to a...

GHSA-4G42-GQRG-4633 Apache Struts vulnerable to memory exhaustion

Denial of service via out of memory OOM owing to no sanity limit on normal form fields in multipart forms. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to an OOM if developer has set...

Apache Struts 安全漏洞

Apache Struts is the United States Apache Apache Foundation, an open source project , is a set of open source MVC framework for creating enterprise-class Java Web applications , mainly provides two versions of the framework products , Struts 1 and Struts 2. Apache Struts denial of service...

CVE-2020-36731

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...