WP Show Posts Plugin for WordPress < 1.1.4 Cross-Site Scripting

The WordPress WP Show Posts Plugin installed on the remote host is affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Qwik < 0.21.0 Code Injection

Qwik in version 0.21.0 provides an extended serialization mechanism for exchanging data between the client and server. Through a specially crafted request on the endpoint /q-data.json, an unauthenticated attacker is able to inject code and execute arbitrary commands No source data...

Apache Tomcat 8.5.x < 8.5.86 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.86, 9.0.0-M1 prior to 9.0.72, 10.1.0-M1 prior to 10.1.6 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by an information disclosure due to the RemoteIpFilter. Note that the scanner has not attempted to...

Atlassian Jira < 8.5.4 Dos Through Gadget API

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to version 8.5.4 or 8.6.0 prior to 8.6.1. It is, therefore, affected by a vulnerability which permits remote attackers to make Jira unresponsive via repeated requests to a certai...

Atlassian Jira < 7.6.0 Xss In SearchRequest.xml Resource

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 7.6.0. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability through...

Atlassian Jira < 5.0.1 Arbitrary File Reads

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 5.0.1. It does, therefore, not properly restrict the capabilities of third-party XML parsers, which allows remote attackers to read arbitrary files or cause a denial of servic...

Atlassian Confluence 7.13.9 < 7.13.12 Embedded Spring-Beans Denial Of Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is 7.13.9 prior to 7.13.12, 7.19.0 prior to 7.19.3. It is, therefore, affected by a Denial of Service DoS attack vulnerability when relying on attacker controlled data binding to set a...

Atlassian Jira < 8.9.0 Improper Authorization In Project Administration

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.9.0. It is, therefore, affected by a vulnerability which permits remote attackers to obtain information about custom project avatars via an improper authorization...

Nginx Cloud Storage HTTP Splitting

The scanner has detected that the Nginx configuration has a directive location specified to query a cloud storage instance. However, it is possible to insert an arbitrary payload containing a line break, which allows a malicious attacker to change the cloud storage instance to be queried. It is...

Nginx Missing Root Location

The scanner has detected that the Nginx installation does not have a directive for the root location '/'. This could potentially leak useful information about the server installation to a remote, unauthenticated attacker. No source data...

Atlassian Jira 8.6.x < 8.8.2 WYSIWYG Editor Cross-Site Scripting

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.5.9 or 8.6.x prior to 8.8.2. It is, therefore, affected by a vulnerability which permits remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting X...

Atlassian Confluence 6.4.3 < 6.6.1 Resource Attachment Content Spoofing

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to version 6.6.1. It may, therefore, permit remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of...

Server-Side Inclusion Injection

A Server-Side Include Injection vulnerability exists when an application embeds and evaluates unsafe user-controlled server-side include directives. By injecting a specific payload an attacker can leverage this vulnerability to conduct a remote code execution. No source data...

Oturia Smart Google Code Inserter Plugin for WordPress < 3.5 Multiple Vulnerabilities

The WordPress Oturia Smart Google Code Inserter Plugin installed on the remote host is affected by multiple vulnerabilities :\n\n - An Authentication Bypass which allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter.\n - An SQL Injection...

Webmin < 1.950 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is prior to 1.950. It is, therefore, affected by multiple vulnerabilities. - An Improper Data Validation Vulnerability affecting the Command Shell Endpoint. - A Cross-Site Scripting affecting the save function of...

Drupal 10.0.x < 10.0.2 Information Disclosure

According to its self-reported version, the instance of Drupal running on the remote web server is 9.4.x prior to 9.4.10, 9.5.x prior to 9.5.2, or 10.0.x prior to 10.0.2. It is, therefore, affected by an information disclosure vulnerability in the Media Library module. Note that the scanner has n...

Drupal 9.4.x < 9.4.10 Information Disclosure

According to its self-reported version, the instance of Drupal running on the remote web server is 9.4.x prior to 9.4.10, 9.5.x prior to 9.5.2, or 10.0.x prior to 10.0.2. It is, therefore, affected by an information disclosure vulnerability in the Media Library module. Note that the scanner has n...

Apache Spark 3.3.0 Stored Cross-Site Scripting

A stored cross-site scripting XSS vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI. Note that the...

phpMyAdmin 5.1.x < 5.1.3 Information Disclosure

The version of phpMyAdmin installed on the remote web server is 4.9.x prior to 4.9.10 or 5.1.x prior to 5.1.3. It is, therefore, affected by an information disclosure that would reveal the path on disk where phpMyAdmin is running from. Note that the scanner has not tested for these issues but has...

phpMyAdmin 4.9.x < 4.9.10 Information Disclosure

The version of phpMyAdmin installed on the remote web server is 4.9.x prior to 4.9.10 or 5.1.x prior to 5.1.3. It is, therefore, affected by an information disclosure that would reveal the path on disk where phpMyAdmin is running from. Note that the scanner has not tested for these issues but has...