15986 matches found
Important: tomcat8
Issue Overview: The fix for CVE-2023-24998 was incomplete for Apache Tomcat 11.0.0-M2 to 11.0.0-M4, 10.1.5 to 10.1.7, 9.0.71 to 9.0.73 and 8.5.85 to 8.5.87. If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a reques...
OpenSSL DoS Vulnerability (20230719) - Windows
OpenSSL is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openssl:openssl";...
Creativeitem Mastery LMS 跨站脚本漏洞
Creativeitem Mastery LMS is an online subscription based LMS software from Creativeitem Bangladesh. A cross-site scripting vulnerability exists in Creativeitem Mastery LMS version 1.2, which stems from a cross-site scripting XSS vulnerability in the parameter search/featured/recommended/skill...
OpenSSL 1.0.2 < 1.0.2zi Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.0.2zi. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.0.2zi advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the...
OpenSSL 1.1.1 < 1.1.1v Multiple Vulnerabilities
The version of OpenSSL installed on the remote host is prior to 1.1.1v. It is, therefore, affected by multiple vulnerabilities as referenced in the 1.1.1v advisory. - Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functio...
kernel: net: sched: fix memory leak in tcindex_set_parms
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindexsetparms Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810c287f00 size 256: comm "syz-executor105", pid 3600,...
U.S. Dept Of Defense: Blind Sql Injection in https://████████/
A blind SQL injection vulnerability was discovered in the █████████ website. This vulnerability allowed an attacker to bypass authentication and retrieve sensitive information from the database. The vulnerability was successfully exploited using SQLmap, a popular SQL injection tool...
WordPress plugin Login Configurator 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...
RecipePoint 1.9 SQL Injection
Exploit Title: RecipePoint 1.9 - SQL Injection Exploit Author: CraCkEr Date: 15/07/2023 Vendor: phpscriptpoint Vendor Homepage: https://phpscriptpoint.com/ Software Link: https://demo.phpscriptpoint.com/recipepoint/ Tested on: Windows 10 Pro Impact: Database Access Description SQL injection attac...
Carlisting 1.6 Cross Site Scripting
Exploit Title: Carlisting 1.6 - Reflected XSS Exploit Author: CraCkEr Date: 16/07/2023 Vendor: phpscriptpoint Vendor Homepage: https://phpscriptpoint.com/ Software Link: https://demo.phpscriptpoint.com/carlisting/ Tested on: Windows 10 Pro Impact: Manipulate the content of the site Description Th...
Bylancer QuickJob SQL注入漏洞
Bylancer QuickJob is an advanced Job Board PHP script from Bylancer. A SQL injection vulnerability exists in Bylancer QuickJob version 6.1, which stems from the presence of an unknown function in the component GET Parameter Handler, which leads to sql injection via the parameters keywords/gender...
SAP NetWeaver ABAP Server Operating System Command Injection Vulnerability
SAP NetWeaver ABAP Server is a German SAP SAP company used as a Web application server for SAP products. SAP NetWeaver ABAP Server suffers from an operating system command injection vulnerability that arises from the application failing to properly filter constructor command special characters,...
CVE-2023-37787
Multiple cross-site scripting XSS vulnerabilities in Geeklog v2.2.2 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Rule and Route parameters of /admin/router.php...
PT-2023-17067
Name of the Vulnerable Software and Affected Versions Elra Parkmatik versions prior to 02.01-a51 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection through SOAP parameter...
Task Reminder System 跨站脚本漏洞
Task Reminder System is a task reminder system by Carlo Montero Personal Developer. A security vulnerability exists in version 1.0 of the Sourcecodester Task Reminder System, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability that could allow an authenticated use...
CVE-2023-38067
In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log...
CVE-2023-38064
In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log...
CVE-2023-38062
In JetBrains TeamCity before 2023.05.1 parameters of the "password" type could be shown in the UI in certain composite build configurations...