Stored Cross-Site Scripting (XSS)

Client-side scripts are used extensively by modern web applications. They perform from simple functions such as the formatting of text up to full manipulation of client-side data and Operating System interaction. Cross Site Scripting XSS allows clients to inject scripts into a request and have th...

GitLab 13.11 < 14.9.5 / 14.10 < 14.10.4 / 15.0 < 15.0.1 (CVE-2022-1940)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to...

PHP 7.4.x < 7.4.30 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 7.4.x prior to 7.4.30, 8.0.x prior to 8.0.20, or 8.1.x prior to 8.1.7. It is, therefore, affected by multiple vulnerabilities: - Uninitialized array in pgqueryparams. CVE-2022-31625 - mysqlnd/pdo...

PHP 8.0.x < 8.0.20 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 7.4.x prior to 7.4.30, 8.0.x prior to 8.0.20, or 8.1.x prior to 8.1.7. It is, therefore, affected by multiple vulnerabilities: - Uninitialized array in pgqueryparams. CVE-2022-31625 - mysqlnd/pdo...

Nginx Plus R1 < R15-P2 / R16 < R16-P1 Multiple Vulnerabilities

According to its self reported version, the installed version of Nginx Plus is R1 built on Open Source version 1.5.3-1 prior to R15-P2 or R16 built on Open Source version 1.15.2 prior to R16-P1. It is, therefore, affected by the following issues : - An unspecified error exists related to the modu...

SAP NetWeaver AS ABAP and Code Injection (3123196)

A code injection vulnerability exists in SAP NetWeaver Application Server ABAP. This could allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This could allow execution of arbitrary commands on the...

BinAbsInspector - Vulnerability Scanner For Binaries

BinAbsInspector Binary Abstract Inspector is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode...

Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

GHSA-XP44-8VWR-XWMV Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure...

Jenkins Aqua Security Scanner Plugin stores credentials in plain text

Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.aquadockerscannerbuildstep.AquaDockerScannerBuilder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

GHSA-3J3V-7F8F-V2XP Jenkins Aqua Security Scanner Plugin stores credentials in plain text

Jenkins Aqua Security Scanner Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.aquadockerscannerbuildstep.AquaDockerScannerBuilder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system...

F5 Networks BIG-IP : Expat vulnerabilities (K91589041)

The version of F5 Networks BIG-IP installed on the remote host is prior to 15.1.9 / 16.1.4 / 17.1.0. It is, therefore, affected by multiple vulnerabilities as referenced in the K91589041 advisory. CVE-2021-45960In Expat aka libexpat before 2.4.3, a left shift by 29 or more places in the storeAtts...

GitLab < 14.7.7 / 14.8.x < 14.8.5 / 14.9.x < 14.9.2 Multiple Vulnerabilities

According to its self-reported version, the instance of GitLab running on the remote web server is prior to 14.7.7 14.8.x prior to 14.8.5, or 14.9.x prior to 14.9.2. It is, therefore, affected by the following vulnerabilities: - Adding a very large number of tags to a runner in GitLab CE/EE allow...

KB5012632: Windows Server 2008 Security Update (April 2022)

The remote Windows host is missing security update 5012632 or cumulative update 5012658. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

SaltStack 3000 < 3002.8 / 3003 < 3003.4 / 3004 < 3004.1 Multiple Vulnerabilities

According to its self-reported version number, the instance of SaltStack hosted on the remote server is affected by multiple vulnerabilities: - Salt Masters do not sign pillar data with the minion's public key, which can result in attackers substituting arbitrary pillar data. CVE-2022-22934 - Job...

Apache Tomcat 8.x < 8.5.78 Spring4Shell CVE-2021-43980

The version of Apache Tomcat installed on the remote host is 8.x prior to 8.5.78. - The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug in Apache Tomcat...

CVE-2017-20015

A vulnerability, which was classified as problematic, was found in WEKA INTEREST Security Scanner up to 1.8. This affects an unknown part of the component LAN Viewer. The manipulation with an unknown input leads to denial of service. Attacking locally is a requirement. The exploit has been...

CVE-2017-20011

A vulnerability was found in WEKA INTEREST Security Scanner 1.8. It has been rated as problematic. This issue affects some unknown processing of the component HTTP Handler. The manipulation with an unknown input leads to denial of service. It is possible to launch the attack on the local host. Th...

CVE-2017-20013

A vulnerability classified as problematic was found in WEKA INTEREST Security Scanner up to 1.8. Affected by this vulnerability is the Stresstest Configuration Handler. A manipulation leads to a local denial of service. The exploit has been disclosed to the public and may be used. NOTE: This...

CVE-2017-20015

A vulnerability, which was classified as problematic, was found in WEKA INTEREST Security Scanner up to 1.8. This affects an unknown part of the component LAN Viewer. The manipulation with an unknown input leads to denial of service. Attacking locally is a requirement. The exploit has been...