4814 matches found
Cross site scripting
Cross-Site Scripting XSS in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields...
CVE-2021-28047
Cross-Site Scripting XSS in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields...
PT-2021-14491 · Unknown +2 · Django-Rest-Registration +2
Name of the Vulnerable Software and Affected Versions: django-registration versions prior to 3.1.2 Description: The django-registration package has an issue where the base user-account registration view does not properly apply filters to sensitive data. This can result in sensitive data being...
django-registration 安全漏洞
James Bennett django-registration is a James Bennett open source application. user registration application for Django. A security vulnerability exists in django-registration that stems from the fact that sensitive data may be included in error reports...
CTF-All-In-One
This repository is an offensive tool for CTF Capture The Flag competitions, specifically targeting Linux systems. The primary vulnerability class is not explicitly stated, but based on the content, it appears to be focused on binary exploitation Pwn. The tool is designed to be used in a CTF...
Webshells Observed in Post-Compromised Exchange Servers
CISA has added two new Malware Analysis Reports MARs to Alert AA21-062A: Mitigate Microsoft Exchange Server Vulnerabilities. Each new MAR AR21-084A and AR21-084B identifies a webshell observed in post-compromised Microsoft Exchange Servers. After successful exploiting a Microsoft Exchange Server...
Connection Failure Reports on Director
Reasons for the Connection failure reports on the Director...
HackerOne: User's who are banned from program can still be invited to the new reports as collaborators
Summary: Hello team! We have found out that the banned user's who are banned from program can be invited to the new reports as collaborator users. This is pretty weird because the hacker should be banned and no new reports shouldn't be allowed. If program bans the hacker the program can't invite...
HackerOne: Lack warning label when receiving a letter
Summary: Hi team, When using the function ShareReportViaEmail the email is sent to the email address specified by the hacker.This email looks legitimate and comes from verification email addresses, leaving no doubt about it being replaced. This endpoint also applies to sandbox reports which makes...
CVE-2020-28150
I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...
CVE-2020-28150
I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...
CVE-2020-28150
CVE-2020-28150 affects I-Net Software Clear Reports 20.10.136 Web application. The vulnerability arises because a user-controlled input is used to specify a link to an external site and is subsequently used in a Redirect, enabling possible open-redirect behavior. Root cause: untrusted input used ...
CVE-2020-28150
I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...
I-Net Software Clear Reports 输入验证错误漏洞
I-net Software I-net software Clear Reports is a Java-based cross-platform reporting application from the German company I-net software I-net Software. The program supports the output of reports in PDF, HTML, PS and RTF formats. A security vulnerability exists in I-Net Software Clear Reports...
chromium -- multiple vulnerabilities
Chrome Releases reports: This release includes 47 security fixes, including the below. Google is aware of reports that an exploit for CVE-2021-21166 exists in the wild. Please see URL for details...
DEBIAN-CVE-2021-23968
If Content Security Policy blocked frame navigation, the full destination of a redirect served in the frame was reported in the violation report; as opposed to the original frame URI. This could be used to leak sensitive information contained in such URIs. This vulnerability affects Firefox 86,...
CVE-2021-23969
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...
UBUNTU-CVE-2021-23969
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...
Mozilla: Content Security Policy violation report could have contained the destination of a redirect
As specified in the W3C Content Security Policy draft, when creating a violation report, "User agents need to ensure that the source file is the URL requested by the page, pre-redirects. If that’s not possible, user agents need to strip the URL down to an origin to avoid unintentional leakage."...