86 matches found
GHSA-VVXF-R4VM-2VM6 Reflected XSS in querystring parameters
An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request. To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload. This will only affect projects...
Reflected XSS in querystring parameters
An attacker could inject a XSS payload in a Silverstripe CMS response by carefully crafting a return URL on a /dev/build or /Security/login request. To exploit this vulnerability, an attacker would need to convince a user to follow a link with a malicious payload. This will only affect projects...
GHSA-RW75-M7GP-92M3 Django data leakage via querystring manipulation in admin
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
Django data leakage via querystring manipulation in admin
The administrative interface contrib.admin in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a tofield...
CVE-2021-23228
DIAEnergie Version 1.7.5 and prior is vulnerable to a reflected cross-site scripting attack through error pages that are returned by “.NET Request.QueryString”...
CVE-2022-38462 - Reflected XSS in querystring parameters
More info at https://www.silverstripe.org/download/security-releases/cve-2022-38462...
CVE-2020-13127
A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.04.1 allows remote authenticated attackers to execute arbitrary SQL commands via the TASKSLISTpt.querystring parameter...
@jurajkubelka/wiki (>=0.9.4, <=0.9.6), bolt-leecher (1.0.1) +8 more potentially affected by CVE-2017-1000048 via qs (>=6.0.0, <=6.0.2)
qs NPM version =6.0.0, =0.9.4, =0.0.12, =1.0.3, =0.1.0-alpha.0, =0.9.4, =0.9.0-beta.1, =0.9.3 - wiki-security-persona 0.1.2 Source cves: CVE-2017-1000048 Source advisory: OSV:GHSA-GQGV-6JQ5-JJJ9...
easy-redirect-manager 2.18.18 - Cross-Site Scripting (XSS)
Any page that causes a 404 or 302 response, will be output within the Redirect Log page without any validation or output encoding, including the URL querystring, which could contain an XSS payload...
CVE-2018-18761
SaltOS 3.1 r8126 allows action=login&querystring=&user=SQL SQL Injection...
cgit < 1.2.1 - cgit_clone_objects() Directory Traversal Vulnerability
Exploit for cgi platform in category web applications There is a directory traversal vulnerability in cgitcloneobjects, reachable when the configuration flag enable-http-clone is set to 1 default: void cgitcloneobjectsvoid if !ctx.qry.path cgitprinterrorpage400, "Bad request", "Bad request";...
Moderate: Red Hat Security Advisory: rh-nodejs6-nodejs-qs security update
An update for rh-nodejs6-nodejs-qs is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
openSUSE Security Update : nodejs (openSUSE-2016-715)
This update for nodejs to version 4.4.5 fixes the several issues. These security issues introduced by the bundled openssl were fixed by going to version 1.0.2h : - CVE-2016-2107: The AES-NI implementation in OpenSSL did not consider memory allocation during a certain padding check, which allowed...
LanWhoIs.exe 1.0.1.120 - Stack Buffer Overflow (PoC)
LanWhoIs.exe 1.0.1.120 - Stack Buffer Overflow PoC ''' + Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/AS-LANWHOIS-BUFFER-OVERFLOW-10062015.txt Vendor: ================================ www.lantricks.com Product:...
HTTP HTML Title Tag Content Grabber
Generates a GET request to the provided webservers and returns the server header, HTML title attribute and location header if set. This is useful for rapidly identifying interesting web applications en mass. This module requires Metasploit: https://metasploit.com/download Current source:...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 QUERYSTRING variable in lib/TWiki.pm or 2 QUERYPARAMSTRING variable in lib/TWiki/UI/View.pm, as demonstrated by the QUERYSTRING to do/view/Main/TWikiPreferences...
CVE-2014-9325: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in TWiki 6.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 QUERYSTRING variable in lib/TWiki.pm or 2 QUERYPARAMSTRING variable in lib/TWiki/UI/View.pm, as demonstrated by the QUERYSTRING to do/view/Main/TWikiPreferences...
Fedora 21 : nodejs-0.10.32-1.fc21 / v8-3.14.5.10-14.fc21 (2014-11132)
This update provides the latest stable version of Node.js and corresponding backports to the v8 package. This update resolves CVE-2013-6668, which has only a minor impact since Node.js is not typically used to execute untrusted JavaScript. For more information on the fixed vulnerability, please s...
Fedora 19 : nodejs-0.10.32-1.fc19 / v8-3.14.5.10-14.fc19 (2014-10975)
This update provides the latest stable version of Node.js and corresponding backports to the v8 package. This update resolves CVE-2013-6668, which has only a minor impact since Node.js is not typically used to execute untrusted JavaScript. For more information on the fixed vulnerability, please s...
Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability
No description provided by source. 1 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Exploit Title: Joomla comspidercatalog SQL injection Vulnerability Dork: inurl:index.php?option=comspidercatalog Date: 31-10-2012 Author:...