12021 matches found
CVE-2021-31682
creationtimestamp| type| source ---|---|--- 2021-10-22 16:39:20+00:00| seen| https://t.me/cibsecurity/31022 2023-04-27 09:58:59+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-31682.yaml 2026-09-01 20:02:11+00:00| seen|...
Cross-site Scripting (XSS) - Stored in archerysec/archerysec
Description The application is vulnerable to a Stored XSS attack. It is possible for an authenticated user to inject a JavaScript payload that will be executed in the web browser of the users viewing the concerned pages. When uploading a Burp scan, the XML field "issueBackground" of a vulnerabili...
Buffer overflow
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Filters. The supported version that is affected is 8.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...
UVI-2021-1001637 HID: usbhid: free raw_report buffers in usbhid_stop
HID: usbhid: free rawreport buffers in usbhidstop This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.71 by commit...
HackerOne: HTML injection in email at https://www.hackerone.com/
HTML injection was possible in emails sent via the HackerOne platform by filling the first name and last name fields with HTML tags on the pentest community application form. This could allow an attacker to send malicious emails and inject HTML into them...
reward tokens could get lost due to rounding down
Handle gpersoon Vulnerability details Impact The function depositRewardTokens divides the "amount" of tokens by allocatedTokensPerEpoch to calculate the endEpoch. When "amount" isn't a multiple of allocatedTokensPerEpoch the result of the division will be rounded down, effectively losing a number...
The formula of number of prizes for a degree is wrong
Handle WatchPug Vulnerability details The formula of the number of prizes for a degree per the document: is: Number of prizes for a degree = 2^bit range^degree - 2^bit range^degree-1 - 2^bit range^degree-2 - ... Should be changed to: Number of prizes for a degree = 2^bit range^degree - 2^bit...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-4177...
Zoho ManageEngine ADManager Plus code issue vulnerability
ZOHO ManageEngine ADManager Plus is a suite of Microsoft Active Directory management software from ZOHO designed for enterprise users using Windows domains. The software assists AD administrators and help desk technicians with day-to-day management tasks, such as bulk management of user accounts...
ECOA BAS controller cross-site request forgery vulnerability
ECOA BAS controller is an intelligent lighting control solution. ECOA BAS controller is vulnerable to cross-site request forgery, which can be exploited by attackers to send forged requests to malicious web pages and execute CRUD commands to perform arbitrary actions on the system...
Exploit for Path Traversal in Apache Http_Server
CVE-2021-41773 Hello guys, yesterday The new CVE-2021-41773 f...
CVE-2021-0689
In RGBtoBGR1portable of SkSwizzleropts.h, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10...
airportgoldentuliphotel.com Cross Site Scripting vulnerability OBB-2158377
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
uToken ERC20 approve method missing return value check #L109
Handle defsec Vulnerability details Impact The initiateVaultFillingZcTokenInitiate function performs an ERC20.approve call but does not check the success return value. Some tokens do not revert if the approval failed but return false instead. Proof of Concept 1. Navigate to "" 2...
Perfect Survey < 1.5.2 - Unauthorised AJAX Call to Stored XSS / Survey Settings Update
The plugin does not have proper authorisation nor CSRF checks in the saveglobalsetting AJAX action, allowing unauthenticated users to edit surveys and modify settings. Given the lack of sanitisation and escaping in the settings, this could also lead to a Stored Cross-Site Scripting issue which wi...
Perfect Survey < 1.5.2 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape multiple parameters id and filterssessionid of singlestatistics page, type and message of importexport page before outputting them back in pages/attributes in the admin dashboard, leading to Reflected Cross-Site Scripting issues...
Far Future Expiry Header < 1.5 - Plugin's Settings Update via CSRF
The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. csrf.submit...
Google Chrome Post-release Reuse Vulnerability (CNVD-2021-99288)
Chrome is a simple and efficient web browsing tool developed by Google. portals in versions prior to Google Chrome 94.0.4606.61 are vulnerable to post-release reuse. An attacker could exploit this vulnerability to be able to perform a sandbox escape via a crafted HTML page...
Cross-Site Scripting (XSS)
edge.js is vulnerable to cross-site scripting. A lack of validation of type when an attacker inputs an array regardless of the use of instead of a string allows an attacker to inject and execute malicious script...