71 matches found
CVE-2022-31629
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...
CVE-2022-31629
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...
CVE-2022-31629: Improper Input Validation
In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cookie by PHP applications...
PT-2022-7421
Name of the Vulnerable Software and Affected Versions PHP versions prior to 7.4.31 PHP versions prior to 8.0.24 PHP versions prior to 8.1.11 Description The issue is related to incorrect input validation in PHP, allowing network and same-site attackers to set a standard insecure cookie in the...
PT-2022-5005 · Hitachi Energy · Hitachi Energy Msm
Name of the Vulnerable Software and Affected Versions: Hitachi Energy MSM versions V2.2 and prior Description: A vulnerability exists in the HTTP web interface where it does not sufficiently verify if a well-formed, valid, consistent request was intentionally provided by the user who submitted th...
CVE-2022-1001
The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape it server side, allowing high privilege users such as admin to perform Cross-Site attacks even when the unfilteredhtml capability is...
Google Android Input Validation Error Vulnerability (CNVD-2022-13210)
Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an input validation error that could be exploited by attackers to trigger a cross-site attack on a victim's device...
Google Android 跨站脚本漏洞
Google Android is a Linux-based open source operating system from Google, Inc. Google Android is vulnerable to an input validation error that could be exploited by attackers to trigger a cross-site attack on a victim's device...
PT-2022-38336
This module enables you to automatically scan images uploaded to the site to extract their meta data and store it in taxonomy structures. The module doesn't sufficiently protect against malicious files being used to attack the site. This vulnerability is mitigated by the fact that an attacker mus...
Cross-Site Request Forgery (CSRF) in myvesta/vesta
✍️ Description Attacker is able to delete any file on the server if logged in user visits attacker website. 🕵️♂️ Proof of Concept Create a test.txt file under /home/user when you logged in open this POC.html in a browser you can check test.txt deletes. //PoC.html history.pushState'', '', '/'...
Couchbase Server Cross-Site Request Forgery Vulnerability
Couchbase Server is a distributed open source NoSQL non-relational database from the U.S. company Couchbase , which mainly supports data query , full-text search and active global replication and other functions . A cross-site request forgery vulnerability exists in Couchbase Server version 6.0. ...
CVE-2020-1103
An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks a variant of cross-site request forgery, CSRF. When users are simultaneously logged in to Microsoft SharePoint Server and visit a...
Microsoft SharePoint Information Disclosure Vulnerability
An information disclosure vulnerability exists where certain modes of the search function in Microsoft SharePoint Server are vulnerable to cross-site search attacks a variant of cross-site request forgery, CSRF. When users are simultaneously logged in to Microsoft SharePoint Server and visit a...
CVE-2019-1199
A remote code execution vulnerability exists in Microsoft Outlook when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrativ...
CVE-2018-6360
mpv through 0.28.0 allows remote attackers to execute arbitrary code via a crafted web site, because it reads HTML documents containing VIDEO elements, and accepts arbitrary URLs in a src attribute without a protocol whitelist in player/lua/ytdlhook.lua. For example, an av://lavfi:ladspa=file= UR...
UBUNTU-CVE-2017-2363
An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. tvOS before 10.1.1 is affected. watchOS before 3.1.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain...
CVE-2016-7274
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka "Window...
Microsoft Edge Scripting Engine Memory Corruption Vulnerability (CNVD-2016-10954)
Microsoft Edge is a Web browser developed by the American company Microsoft Microsoft. A memory corruption vulnerability exists in the scripting engine implementation of Microsoft Edge's handling of in-memory objects, which can be exploited by an attacker via a specially crafted Web site to run...
CVE-2016-5266
Mozilla Firefox before 48.0 does not properly restrict drag-and-drop aka dataTransfer actions for file: URIs, which allows user-assisted remote attackers to access local files via a crafted web site...
