9570 matches found
SUSE CVE-2020-11077
In Puma RubyGem before 4.3.5 and 3.12.6, a client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the firs...
SUSE CVE-2020-15675
When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash. This vulnerability affects Firefox 81...
SUSE CVE-2021-4091
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash...
The XSS playload injected in "Display Name" parameter in creating Contacts are vulnerable to Cross-Site Scripting (Stored/Persistent)
Description The XSS playload injected in "Display Name" parameter in creating Contacts are vulnerable to Cross-Site Scripting Stored/Persistent. Steps to Reproduce: 1. First is go to the user dashboard then contacts: https://demo.modoboa.org/contacts// 2. Then Add new contact, enter the payload...
XSS in Comment Faq news username parameter
Description Stored Cross-Site Scripting XSS is a type of security vulnerability that occurs when an attacker injects malicious code into a website that is then stored on the server and served to unsuspecting users. This type of XSS is particularly dangerous because it can persist and continue to...
Solving one of NOBELIUM’s most novel attacks: Cyberattack Series
Our story begins with eight Microsoft Detection and Response Team DART analysts gathered around a customer’s conference room to solve a cybersecurity mystery. Joined by members of the customer’s cybersecurity team, they were there to figure out how a Russia-based nation-state hacking group known ...
Cross site scripting
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In...
CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In...
CVE-2023-24814
TYPO3 CVE-2023-24814 is a persisted cross-site scripting vulnerability in the TYPO3 core where GeneralUtility::getIndpEnv() reads PATH_INFO and, with config.absRefPrefix=auto, can inject HTML that gets cached and served to visitors. Affected: TYPO3 core components with PATH_INFO handling; affecte...
CVE-2023-24814: Improper Neutralization of Input During Web Page Generation
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component GeneralUtility::getIndpEnv uses the unfiltered server environment variable PATHINFO, which allows attackers to inject malicious content. In...
Malicious code in @tangoch/add-two (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db14ce679d7f0dd262266021768200a695a57df3a2609fb5b98bd03ebca95d3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-42908
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persiste...
Cross site scripting
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persiste...
CVE-2022-42908
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persiste...
CVE-2022-42908
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persiste...
CVE-2022-42908: Improper Neutralization of Input During Web Page Generation
WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persiste...
PT-2025-13322
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential NULL dereference issue has been identified in the Linux kernel, specifically in the efi mem reserve persistent function. The issue occurs when iterating on a linked list and ...
Malicious code in solc-0.8 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cb2ef4de1156c7094d66ff9e85b4e9b17b04b11eb2348040a1f7c8756c7b0a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Dell Enterprise SONiC OS Resource Management Vulnerability
Dell Enterprise SONiC OS Dell Enterprise Sonic Operating System is an open-source network operating system from Dell, USA. A resource management error vulnerability exists in Dell Enterprise SONiC OS, versions 3.5.3, 4.0.0, 4.0.1, and 4.0.2, which stems from a security issue contained in the...
When Pwning Cisco Persistence Is Key When Pwning Supply Chain Cisco Is Key
When Pwning Cisco, Persistence is Key - When Pwning Supply Chain, Cisco is Key By Trellix · February 1, 2023 This story was also written by Kasimir Schulz and Sam Quinn. Unlike those of the past, modern routers now function like high-powered servers with many ethernet ports running not only routi...