2834 matches found
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C 8.2 Problem TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In combination with the TypoScript setting...
GHSA-R4F8-F93X-5QH3 TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C 8.2 Problem TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In combination with the TypoScript setting...
CVE-2023-24814
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In...
CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In...
TYPO3 8.7.0 < 8.7.51 ELTS / 9.0.0 < 9.5.40 ELTS / 10.0.0 < 10.4.36 / 11.0.0 < 11.5.23 / 12.0.0 < 12.2.0 XSS (TYPO3-CORE-SA-2023-001)
The version of TYPO3 installed on the remote host is prior to 8.7.0 8.7.51 ELTS / 9.0.0 9.5.40 ELTS / 10.0.0 10.4.36 / 11.0.0 11.5.23 / 12.0.0 12.2.0. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2023-001 advisory. - TYPO3 core component...
Veeam One Web Client / Reporter: Access Denied Error
Challenge When attempting to access the Veeam ONE Web Client, formerly known as Veeam ONE Reporter, the following error is shown on the login page: Veeam ONE Web Client Error Access denied Here is what you can do: Go Home Error Variant 1 Error Variant 2 Cause The Internet Information Services IIS...
[SECURITY] Fedora 36 Update: awstats-7.8-9.fc36
Advanced Web Statistics is a powerful and full-featured tool that generates advanced web server graphical statistics. This server log analyzer works from the command line or as a CGI and shows all information your log contains, in graphical web pages. It can analyze a lot of web/wap/proxy servers...
Fedora: Security Advisory for awstats (FEDORA-2023-fda5480804)
The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
Design/Logic Flaw
Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands...
CVE-2022-42136
Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands...
CVE-2022-42136
CVE-2022-42136 affects MailEnable on Windows. Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had access, enabling an attacker to store arbitrary code on those files and execute Remote Code Execution (RCE). The ...
CVE-2022-36664
Password Manager for IIS 2.0 has a cross-site scripting XSS vulnerability via the /isapi/PasswordManager.dll ResultURL parameter...
Cross site scripting
Password Manager for IIS 2.0 has a cross-site scripting XSS vulnerability via the /isapi/PasswordManager.dll ResultURL parameter...
CVE-2022-36664
CVE-2022-36664 concerns Password Manager for IIS 2.0. The vulnerability is a cross-site scripting (XSS) flaw exposed via the /isapi/PasswordManager.dll endpoint, specifically through the ResultURL parameter. Public references (Exploit-DB, packetstorm) describe an HTTP POST to POST /isapi/Password...
CVE-2022-36664
Password Manager for IIS 2.0 has a cross-site scripting XSS vulnerability via the /isapi/PasswordManager.dll ResultURL parameter...
CVE-2022-36664
Password Manager for IIS 2.0 has a cross-site scripting XSS vulnerability via the /isapi/PasswordManager.dll ResultURL parameter...
PT-2022-23535 · Unknown · Password Manager For Iis
Name of the Vulnerable Software and Affected Versions: Password Manager for IIS version 2.0 Description: The issue is a cross-site scripting XSS vulnerability. It occurs via the "/isapi/PasswordManager.dll" API endpoint, specifically through the ResultURL parameter. This allows for potential...
IIS modules: The evolution of web shells and how to detect them
Web exploitation and web shells are some of the most common entry points in the current threat landscape. Web servers provide an external avenue directly into your corporate network, which often results in web servers being an initial intrusion vector or mechanism of persistence. Monitoring for...
IIS modules: The evolution of web shells and how to detect them
Web exploitation and web shells are some of the most common entry points in the current threat landscape. Web servers provide an external avenue directly into your corporate network, which often results in web servers being an initial intrusion vector or mechanism of persistence. Monitoring for...
