15992 matches found
TaxoPress < 3.6.5 - Editor+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
The vulnerability of the curl command-line utility relates to its inability to clean up special elements in another plane, allowing a malicious actor to execute arbitrary code within the system.
The vulnerability of the curl command-line utility is related to data exchange using the TELNET protocol. This allows a malicious individual to send a specially created username and “telnet parameters” during server authentication. Exploiting this vulnerability enables a remote attacker to send...
The vulnerability of the libcurl library, related to bypassing the authentication process, allows a perpetrator to reuse an inappropriate connection.
The vulnerability of the libcurl library relates to bypassing the authentication process. Exploiting this vulnerability allows a malicious actor to easily manipulate two SSH parameters, which may lead to the reuse of an inappropriate connection. As a result, an already established SSH connection...
Design/Logic Flaw
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping o...
CVE-2023-29509 org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping o...
CVE-2023-29847
AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the commentauthor and commentcontent parameters at /post.php. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload...
Cross site scripting
AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the commentauthor and commentcontent parameters at /post.php. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload...
debugHunter - Discover Hidden Debugging Parameters And Uncover Web Application Secrets
Discover hidden debugging parameters and uncover web application secrets with debugHunter. This Chrome extension scans websites for debugging parameters and notifies you when it finds a URL with modified responses. The extension utilizes a binary search algorithm to efficiently determine the...
CVE-2023-29847
AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting XSS vulnerabilities via the commentauthor and commentcontent parameters at /post.php. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload...
Booqable Rental <= 2.4.16 - Admin+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow users with a role of Admin to perform Cross-Site Scripting attacks...
CVE-2022-33258
Information disclosure due to buffer over-read in modem while reading configuration parameters...
Lenovo Smart Clock Essential 信任管理问题漏洞
Lenovo Smart Clock Essential is a smart stereo from Chinese company Lenovo Lenovo. Lenovo Smart Clock Essential version 4.9.113 suffers from a Trust Management Issue vulnerability that stems from the presence of a hard-coded password vulnerability, which can be exploited by an attacker to enhance...
New Cylance Ransomware Targets Linux and Windows Operating Systems
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Cylance ransomware is a new malware that is capable of adjusting to customized encryption tactics and can accept different command-line parameters. To receive real-time threat advisories, please follow...
Remote Code Execution (RCE)
org.apache.linkis:linkis-datasource is vulnerable to Remote Code Execution RCE. A remote attacker is able to upload and execute malicious code on the system, using MySQL data source and malicious parameters to configure a new data source which triggers insecure deserialization...
Remote Code Execution (RCE)
org.apache.linkis:linkis-engineplugin-jdbc is vulnerable to Remote Code Execution RCE. Improper parameter filtering allows an attacker to upload and execute malicious code on the system, using malicious Mysql JDBC parameters in JDBC EngineConn Module which may trigger insecure deserialization...
Apache Linkis Code Execution Vulnerability (CNVD-2023-80566)
Apache Linkis is a library of the U.S. Apache Apache Foundation. Helps to easily connect various backend compute/storage engines. A code execution vulnerability exists in Apache Linkis 1.3.1 and earlier versions, which stems from a lack of valid filtered parameters, and can be exploited by an...
Adobe Substance 3D Stager 缓冲区错误漏洞
Adobe Substance 3D Stager is a virtual 3D studio from the American company Audobee Adobe. A heap buffer overflow vulnerability exists in Adobe Substance 3D Stager in versions 2.0.1 and earlier. The vulnerability stems from a failure to perform security checksums on parameters in a user's context,...
OESA-2023-1207 openssl security update
OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains...
Code Injection
apache-airflow-providers-apache-hive is vulnerable to Code Injection. The vulnerability exists because of the improper control of the hook parameters in the library, which allows an attacker to inject and execute malicious code...