1656 matches found
FusionPBX 跨站脚本漏洞
FusionPBX is an open source enterprise IPPBX interface management system based on FreeSWITHC. A cross-site scripting vulnerability exists in FusionPBX version 4.5.7. An attacker can exploit this vulnerability to inject arbitrary Web script or HTML via the querystring variable in...
python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters
The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon ;, they can cause a difference in the interpretation of the request...
Lightmeter ControlCenter 安全漏洞
Lightmeter ControlCenter is a Lightmeter open source application . A monitoring and analysis system for Postfix mail servers . A security vulnerability exists in Lightmeter ControlCenter 1.1.0 through 1.5.x before 1.5.1, which stems from the fact that anyone who knows the URL of a publicly...
GHSA-PR5M-4W22-8483 NanoHTTPD Cross-site Scripting vulnerability
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, becaus...
Design/Logic Flaw
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, becaus...
CVE-2020-13697
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, becaus...
PT-2021-9673
Name of the Vulnerable Software and Affected Versions NanoHTTPD versions through 2.3.1 Description An issue was discovered in RouterNanoHTTPD.java. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without...
CVE-2020-13697: Improper Neutralization of Input During Web Page Generation
An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, becaus...
NanoHTTPD Cross-Site Scripting Vulnerability
LordFokas NanoHTTPD is an application for GlobalLordFokas individual developers. It provides a lightweight HTTP server designed for embedding in other applications. A cross-site scripting vulnerability exists in NanoHTTPD through 2.3.1, which stems from the GeneralHandler GET handler printing use...
AZL-84275 CVE-2021-23336 affecting package docbook5-style-xsl 1.79.2-11
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can...
Micrium uC-HTTP HTTP Server null pointer dereference denial-of-service vulnerability
Summary A denial-of-service vulnerability exists in the HTTP Server functionality of Micrium uC-HTTP 3.01.00. A specially crafted HTTP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. Tested Versions Micrium uC-HTTP 3.01.00 Product URLs...
undertow: special character in query results in server errors
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability...
undertow: special character in query results in server errors
A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability...
OX App Suite Cross-Site Scripting Vulnerability (CNVD-2021-02805)
OX App Suite is a modular platform designed for telcos, hosting companies and vendors to deliver a wide range of cloud-based services. A cross-site scripting vulnerability exists in OX App Suite 7.10.3 and earlier versions. The vulnerability can be exploited by an attacker to conduct a cross-site...
CVE-2021-23928
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string...
Design/Logic Flaw
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string...
CVE-2021-23928
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string...
CVE-2021-23928: Improper Neutralization of Input During Web Page Generation
OX App Suite through 7.10.3 allows XSS via the ajax/apps/manifests query string...
