What Does The Fox Hack? Breaking Down the Anonymous Fox F-Automatical Script

While performing routine security research, one of our threat analysts discovered the latest version of a Command and Control C2 script, which is referred to as F-Automatical within the script’s code and was commonly known as FoxAuto in older versions. This is the seventh version of this automati...

Consensys: CSV Injection at https://assets-paris-demo.codefi.network/

Summary: Hi consensys Security Team. I have found CSV Injection when generate report at https://assets-paris-demo.codefi.network/ CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program such as Microsoft Excel or...

CVE-2022-41576

The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices...

PT-2022-25949 · Unknown · Rphone Module

Name of the Vulnerable Software and Affected Versions: rphone module affected versions not specified Description: The issue concerns a script in the rphone module that can be maliciously modified, potentially leading to the implantation of irreversible programs on user devices. Recommendations: A...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a vulnerability in the rphone module where a script can be maliciously modified...

Security Bulletin: IBM Security Access Manager for Enterprise Single Sign On Cross Site Scripting Vulnerability (CVE-2013-6745)

Abstract A dynamic web form is vulnerable to a cross-site scripting XSS attack Content VULNERABILITY DETAILS: CVE ID: CVE-2013-6745 DESCRIPTION: A dynamic web form is vulnerable to a cross-site scripting XSS attack. A remote attacker could exploit this vulnerability using JavaScript code to injec...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a content management solution from Adobe that can be used to build websites, mobile applications and forms. The solution supports mobile content management, marketing and sales campaign management, and multi-site management, etc. A cross-site scripting vulnerabilit...

Qsmart Next 跨站脚本漏洞

Qsmart Next is a free smartphone application from Qsmart Inc. A security vulnerability exists in Qsmart Next version v4.1.2, which can be exploited by an attacker to inject malicious scripts into other benign and trusted websites...

CVE-2022-39799

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user...

CVE-2022-39799

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user...

PT-2022-24309 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI version 5.8.6 Description: A cross-site scripting XSS issue was found in Nagios XI via the System Settings page under the Admin panel. This allows for potential malicious script execution. Recommendations: For Nagios XI version 5.8....

Cross-site Scripting (XSS)

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to the error handling mechanism during plugin deactivation or deletion. An attacker can inject malicious scripts by...

PT-2022-23601 · Unknown · Picuploader

Name of the Vulnerable Software and Affected Versions: PicUploader version 2.6.3 Description: A cross-site scripting XSS issue was found in the /master/index.php component of PicUploader. This allows for potential malicious script execution. Recommendations: For PicUploader version 2.6.3, conside...

Remote Code Execution (RCE)

vim is vulnerable to remote code execution. The vulnerability exists due to a Use After Free which allowing an attacker to inject maliciously crafted script into the system...

Cross-site Scripting (XSS)

github.com/phachon/mm-wiki is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of the user input allowing an attacker to inject maliciously crafted script into the system...

Cross-Site Request Forgery

getkirby/kirby is vulnerable to cross-site request forgery. The vulnerability exists because delete page functionality is not properly handled which allows a remote attacker to inject and execute malicious script into the system...

CVE-2022-34486

Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious script via unspecified vectors...

Path traversal

Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious script via unspecified vectors...

CVE-2022-34486

Path traversal vulnerability in PukiWiki versions 1.4.5 to 1.5.3 allows a remote authenticated attacker with an administrative privilege to execute a malicious script via unspecified vectors...

CVE-2022-34486

CVE-2022-34486 concerns a path traversal vulnerability in PukiWiki versions 1.4.5–1.5.3. The issue allows a remote authenticated attacker with administrative privileges to execute a malicious script via unspecified vectors, indicating a potentially high impact (CVE details show high severity in s...