31 matches found
CVE-2025-66850
발견 사항 'LibreNMS' 애플리케이션에서 반사형 크로스 사이트 스크립팅Reflected XSS 취약점을 발견했습니다. 이 취약점은 라우팅 모듈의 protocol 매개변수에 존재하며, 공격자가 피해자의 브라우저에서 악성 JavaScript를 실행할 수 있게 합니다. 이 취약점은 22.9.02022년 9월부터 24.9.12024년 9월까지 모든 버전에 영향을 미칩니다. 이 취약점은 이후 CVE나 공개 공지 없이 24.10.02024년 11월에서 조용히 패치되었습니다. 문서화되지 않은 수정으로 인해 많은 조직이 자사의 노출을...
CVE-2026-96652
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...
CVE-2026-96652 Plex Media Server SSRF
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...
CVE-2026-96652 Plex Media Server SSRF
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...
EUVD-2026-85367
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...
CVE-2026-96652
Plex Media Server versions prior to 1.43.3.10861 are vulnerable to Server-Side Request Forgery (SSRF) via the /player/timeline endpoint. An attacker who possesses any valid X-Plex-Token can manipulate the protocol parameter to include a full URL, forcing the server to perform a POST request to a ...
PT-2026-97403
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...
CVE-2026-96652: Server-Side Request Forgery (SSRF)
Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...
PT-2026-32147
Name of the Vulnerable Software and Affected Versions Totolink A7100RU version 7.4cu.2313 b20191024 Description A vulnerability exists in the Totolink A7100RU router, specifically within the CGI Handler component. Manipulation of the proto argument in the setNetworkCfg function of the...
CVE-2025-45057
D-Link DI-8300 v16.07.26A1 was discovered to contain a buffer overflow via the ip parameter in the ippositionasp function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted input...
CVE-2019-25417
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the protocol parameter. Attackers can send POST requests to the QoS rules management endpoint with JavaScript payloads in the protoco...
CVE-2019-25417
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the protocol parameter. Attackers can send POST requests to the QoS rules management endpoint with JavaScript payloads in the protoco...
CVE-2019-25417 Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS Rules
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the protocol parameter. Attackers can send POST requests to the QoS rules management endpoint with JavaScript payloads in the protoco...
CVE-2019-25417
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the protocol parameter. Attackers can send POST requests to the QoS rules management endpoint with JavaScript payloads in the protoco...
CVE-2019-25417
The CVE concerns Comodo Dome Firewall 2.7.0 with a reflected cross-site scripting flaw in the QoS rules management endpoint. Attackers can submit crafted input in the protocol parameter via POST requests, causing JavaScript to execute in administrator browsers. Root cause: input reflected into a ...
CVE-2019-25417 Comodo Dome Firewall 2.7.0 Reflected Cross-Site Scripting via QoS Rules
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the protocol parameter. Attackers can send POST requests to the QoS rules management endpoint with JavaScript payloads in the protoco...
PT-2026-20820
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the protocol parameter. Attackers can send POST requests to the QoS rules management endpoint with JavaScript payloads in the protoco...
CVE-2019-25417: Improper Neutralization of Input During Web Page Generation
Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the protocol parameter. Attackers can send POST requests to the QoS rules management endpoint with JavaScript payloads in the protoco...
CVE-2025-29228
Linksys E5600 router firmware version 1.1.0.26 is vulnerable to a command injection flaw in the runtime.macClone function. The vulnerability is triggered via the mc.ip parameter, potentially allowing an attacker to execute arbitrary commands. To remediate this, users should update to a newer vers...
CVE-2025-34302
IPFire versions prior to 2.29 Core Update 198 contain a stored cross-site scripting XSS vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the PROT parameter when creating a new service. When a user adds a service, the application issues an HTTP POST...