CVE-2021-29387

Multiple stored cross-site scripting XSS vulnerabilities in Sourcecodester Equipment Inventory System 1.0 allow remote attackers to inject arbitrary javascript via any "Add" sections, such as Add Item , Employee and Position or others in the Name Parameters...

Saad Irfan RemoteClinic 跨站脚本漏洞

Remote Clinic is an open source clinic management system that allows you to remotely manage your clinic via the Web. A cross-site scripting vulnerability exists in Remote Clinic v2.0. The vulnerability can be exploited to inject arbitrary script or html via the First Name or Last Name field of...

CVE-2019-18992

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992

OpenWrt 18.06.4 allows XSS via these Name fields to the cgi-bin/luci/admin/network/firewall/rules URI: "Open ports on router" and "New forward rule" and "New Source NAT" this can occur, for example, on a TP-Link Archer C7 device...

CVE-2019-18992

CVE-2019-18992 is an XSS vulnerability in OpenWrt 18.06.4. It affects the /cgi-bin/luci/admin/network/firewall/rules API, where the Name fields (e.g., “Open ports on router”, “New forward rule”, “New Source NAT”) can be crafted to inject script. The issue is demonstrated on devices such as TP-Lin...

PT-2019-15743 · Tp Link +1 · Tp-Link Archer C7 +1

Name of the Vulnerable Software and Affected Versions: OpenWrt version 18.06.4 Description: The issue allows for XSS via the Name fields in the /cgi-bin/luci/admin/network/firewall/rules API endpoint, specifically in the "Open ports on router", "New forward rule", and "New Source NAT" fields. Thi...

CVE-2019-16195

Centreon before 2.8.30, 18.x before 18.10.8, and 19.x before 19.04.5 allows XSS via myAccount alias and name fields...

PHP Scripts Mall Advance B2B Script Cross-Site Scripting Vulnerability

PHP Scripts Mall Advance B2B Script is a set of PHP-based scripts for B2B business-to-business trading websites. PHP Scripts Mall Advance B2B Script 2.1.4 suffers from a cross-site scripting vulnerability that can be exploited by an attacker via the FIRST NAME or LAST NAME field...

Netis ADSL Router DL4322D Cross-Site Scripting Vulnerability

DL4322D is a router product from Netis Systems. The Netis ADSL Router DL4322D suffers from a cross-site scripting vulnerability that could allow an attacker to add a cross-site scripting attack on dynamic DNS host name fields...

CVE-2017-18177

Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1...

Buffer overflow

plugins/preauth/pkinit/pkinitcryptoopenssl.c in MIT Kerberos 5 aka krb5 through 1.15.2 mishandles Distinguished Name DN fields, which allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow and application crash in situations involving untrusted X.509 data,...

CVE-2017-15088

plugins/preauth/pkinit/pkinitcryptoopenssl.c in MIT Kerberos 5 aka krb5 through 1.15.2 mishandles Distinguished Name DN fields, which allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow and application crash in situations involving untrusted X.509 data,...

DEBIAN-CVE-2017-15088

plugins/preauth/pkinit/pkinitcryptoopenssl.c in MIT Kerberos 5 aka krb5 through 1.15.2 mishandles Distinguished Name DN fields, which allows remote attackers to execute arbitrary code or cause a denial of service buffer overflow and application crash in situations involving untrusted X.509 data,...

CVE-2009-4907

Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...

CVE-2009-4907

Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...

embedded zero in cert name

SSL and TLS Server certificates contain one or more fields with server name or otherwise matching patterns. These strings are stored as content and length within the certificate, and thus there is no particular terminating character. curl's OpenSSL interfacing code did faulty assumptions about...

TLS certificates can be used to execute arbitrary code – Opera Security Advisories

TLS certificates can be used to execute arbitrary code – Opera Security Advisories OPCOM Team | February 13, 2009 Severity Highly Severe Problem Description When connecting to a TLS-protected website, Opera parses the X.509 certificate. If a site uses a specially crafted Subject Alternative Name ...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Ripe CMS: crossite scripting in http://site/contact-us with Name, address, Subject fields...

WordPress 1.2.x XSS Advisory

Module: wp-admin/profile.php Fields: First Name, Last Name. Нет проверки на знаки & Возможно внедрение java-скрипта. Патч: http://adz.void.ru/file.php?op=get&id=6 Описание: http://adz.void.ru/index.php?p=5 ------------ Легкой Смерти!...

DEBIAN-CVE-2001-0775

Buffer overflow in xloadimage 4.1 aka xli 1.16 and 1.17 in Linux allows remote attackers to execute arbitrary code via a FACES format image containing a long 1 Firstname or 2 Lastname field...