Carbon Forum 5.9.0 Cross Site Scripting

Exploit Title: Persistent XSS in Carbon Forum 5.9.0 Stored Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.94cb.com/ Software Link: https://github.com/lincanbin/Carbon-Forum Version: 5.9.0 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent stored XSS...

CVE-2024-37130

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their privilege to the admin user and gain full control of the...

CVE-2024-37130

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their privilege to the admin user and gain full control of the...

CVE-2024-37130

CVE-2024-37130 (Dell OpenManage Server Administrator) is a Local Privilege Escalation via XSL Hijacking . Affected: Dell OpenManage Server Administrator versions 11.0.1.0 and prior . Root cause: an XSL hijack path enabling a local, low-privileged user to escalate to the admin user, potentially le...

CVE-2024-37130

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their privilege to the admin user and gain full control of the...

CVE-2024-37130

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their privilege to the admin user and gain full control of the...

Dell OpenManage Server Administrator Local Lift Vulnerability

Dell OpenManage Server Administrator is a server management tool for server monitoring and configuration. Dell OpenManage Server Administrator suffers from a local elevation vulnerability caused by XSL Hijacking, which can be exploited by a low-privileged attacker to elevate to administrator...

Dell OpenManage Server Administrator 代码问题漏洞

Dell OpenManage Server Administrator is a server management tool for server monitoring and configuration. Dell OpenManage Server Administrator suffers from a local elevation vulnerability caused by XSL Hijacking, which can be exploited by a low-privileged attacker to elevate to administrator...

Cisco Finesse Web Management Interface Cross-Site Request Forgery Vulnerability

Cisco Finesse is the United States Cisco Cisco company's set of call center management software. A cross-site request forgery vulnerability exists in the Cisco Finesse web management interface, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to...

PT-2024-27322 · Dell · Dell Openmanage Server Administrator

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Server Administrator versions 11.0.1.0 and prior Description: The issue is a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and...

GHSA-F777-F784-36GM TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

TYPO3 Security Misconfiguration in Install Tool Cookie

It has been discovered that cookies created in the Install Tool are not hardened to be submitted only via HTTP. In combination with other vulnerabilities such as cross-site scripting it can lead to hijacking an active and valid session in the Install Tool...

CVE-2024-3402

A stored Cross-Site Scripting XSS vulnerability existed in version 20240121 of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model,...

CVE-2024-3402 Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt

A stored Cross-Site Scripting XSS vulnerability existed in version 20240121 of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model,...

CVE-2024-3402 Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt

A stored Cross-Site Scripting XSS vulnerability existed in version 20240121 of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model,...

CVE-2024-5673 Cross-Site Scripting in PHP File Manager by Dulldusk

Vulnerability in Dulldusk's PHP File Manager affecting version 1.7.8. This vulnerability consists of an XSS through the fmcurrentdir parameter of index.php. An attacker could send a specially crafted JavaScript payload to an authenticated user and partially hijack their browser session...

PHP File Manager security vulnerability

PHP File Manager is a complete file system management tool from the individual developers at Dulldusk. A security vulnerability exists in PHP File Manager version 1.7.8, which stems from the presence of a cross-site scripting XSS vulnerability that allows an attacker to hijack a browser session b...

Cisco Finesse 安全漏洞

Cisco Finesse is the United States Cisco Cisco company's set of call center management software. A cross-site request forgery vulnerability exists in the Cisco Finesse web management interface, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to...

Monstra CMS 3.0.4 - Remote Code Execution Exploit

Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution RCE Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://monstra.org/ Software Link: https://monstra.org/monstra-3.0.4.zip Version: 3.0.4 Tested on: MacOS import requests import random import string import time import re import sys if...

CVE-2024-36905

In the Linux kernel, the following vulnerability has been resolved: tcp: defer shutdownSENDSHUTDOWN for TCPSYNRECV sockets TCPSYNRECV state is really special, it is only used by cross-syn connections, mostly used by fuzzers. In the following crash 1, syzbot managed to trigger a divide by zero in...