293 matches found
Preventing Web Application Access Control Abuse
SUMMARY The Australian Signals Directorate’s Australian Cyber Security Centre ACSC, U.S. Cybersecurity and Infrastructure Security Agency CISA, and U.S. National Security Agency NSA are releasing this joint Cybersecurity Advisory to warn vendors, designers, and developers of web applications and...
WordPress Plugin Responsive Tabs horizontal vertical and accordion Tabs 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-24418
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin = 3.2 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin = 3.2 versions...
CVE-2023-24418
CVE-2023-24418 affects the WordPress plugin Tiny carousel horizontal slider plus (admin+). The vulnerability is a Stored Cross-Site Scripting (XSS) in versions
Tiny carousel horizontal slider plus <= 3.2 - Admin+ Stored XSS
The plugin does not escape several fields in the edit gallery and edit image forms, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
WordPress plugin Tiny carousel horizontal slider plus 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
CVE-2023-29194
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces...
Design/Logic Flaw
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces...
CVE-2023-29194 vitess allows users to create keyspaces that can deny access to already existing keyspaces
Vitess is a database clustering system for horizontal scaling of MySQL. Users can either intentionally or inadvertently create a keyspace containing / characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces...
CVE-2023-29194
Vitess CVE-2023-29194 describes a logic flaw that allows creation of a keyspace containing a slash (/), which can cause VTAdmin (and in some references vtctldclient GetKeyspaces) to error when listing or viewing keyspaces. The underlying issue affects how keyspaces with a slash are handled and ma...
Dell PowerScale OneFS elevation of privilege vulnerability (CNVD-2023-65221)
Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. An elevation of privilege vulnerability exists in Dell PowerScale OneFS, which can be exploited by attackers to cause a denial of service, privilege escalation, a...
Dell PowerScale OneFS Information Disclosure Vulnerability (CNVD-2023-65223)
Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. Dell PowerScale OneFS suffers from an information disclosure vulnerability that originates when a program exposes sensitive information to unauthorized actors,...
CVE-2023-26047 teler-waf contains detection rule bypass via entities payload
teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...
VuCSA - Vulnerable Client-Server Application - Made For Learning/Presenting How To Perform Penetration Tests Of Non-Http Thick Clients
Vulnerable Client-Server Application Vulnerable client-server application VuCSA is made for learning/presenting how to perform penetration tests of non-http thick clients. It is written in Java with JavaFX graphical user interface. Currently the vulnerable application contains the following...
SourceCodester Hospital Patient Records Management System horizontal override vulnerability
SourceCodester Hospital Patient Records Management System is a web-based application that provides an automated platform for hospitals to store and manage their patient records. sourceCodester Hospital Patient Records Management System version 1.0 contains a horizontal override vulnerability, whi...
Sourcecodester Hospital Patient Records Management System 安全漏洞
SourceCodester Hospital Patient Records Management System is a web-based application that provides an automated platform for hospitals to store and manage their patient records. sourceCodester Hospital Patient Records Management System version 1.0 contains a horizontal override vulnerability, whi...
EXNESS: Access control vulnerability (read/write)
Horizontal privilege escalation that could be used to gain read/write access to some resources not associated with the current user...