CVE-2024-43738

Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could allow an attacker to execute arbitrary code in the context of the victim's browser. This issue occurs when data from a malicious source is processed by a web...

GeoServer 2.10.0 < 2.24.4 Sensitive Information Exposure

According to its banner, the version of GeoServer running on the remote host is 2.10.0 prior to 2.24.4 or 2.25.x prior to 2.25.1. It is, therefore, affected by a Sensitive Information Exposure. Note that the scanner has not tested for these issues but has instead relied only on the application's...

Ivanti EPM XML External Entity

Ivanti Endpoint Manager EPM versions 2022 SU6 / 2024 SU1 are vulnerable to an XML External Entity allowing an unauthenticated attacker to read arbitrary files from the system via a specially crafted request. No source data...

Spring Eureka Detected

Spring Eureka is a service discovery and registration server. It enables microservices to dynamically discover and communicate with each other without hardcoded hostnames and ports. The scanner detected the usage of Spring Eureka on the target application. No source data...

PhpSysInfo Detected

PhpSysInfo is a customizable PHP script that displays information about the system. The scanner detected the usage of PhpSysInfo on the target application. No source data...

Virtual Hosts Detected

This is an informational plugin to inform the user that the scanner detected the presence of one or multiple virtual hosts on the target server. No source data...

CVE-2020-23839

creationtimestamp| type| source ---|---|--- 2024-11-14 06:08:22+00:00| seen| MISP/4ee581f0-3169-41ab-8972-0ccc497d7809...

Robomongo File Detected

A Robomongo file have been detected on the target web application. These files may contain sensitive information which could assist an attack to conduct further attacks. No source data...

Clockwork Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Clockwork instance on the target application. No source data...

SonarQube Public Projects Detected

A SonarQube Public Projects response have been detected on the target web application. These response may contain sensitive information which could assist an attack to conduct further attacks. No source data...

Dolibarr 16.x < 16.0.5 Database Download

Dolibarr versions 16.x 16.0.5 suffer from an improper access control vulnerability, allowing a remote and unauthenticated attacker to access the target instance contact database, including public and private notes. No source data...

Gradio < 4.37.1 Open Redirect

Gradio before version 4.37.1 suffer from an open redirect vulnerability, allowing an attacker to craft a link and try redirecting target applications users to a malicious server. This detection is included in the AI and LLM category. No source data...

Apache Tapestry Arbitrary File Read

Apache Tapestry versions 5.4.0 5.6.2 and 5.7.0 5.7.1 allows an unauthenticated attacker to access Class files via a specially crafted request. If the value of 'tapestry.hmac-passphrase' is recovered, this vulnerability can be exploited to obtain arbitrary code execution through the value of the...

Laravel Weak Secret Key

Laravel applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in the .env file and is used for multiple security-critical operations. When a weak or easily guessable application key is used, it...

Pyramid Weak Secret Key

Pyramid applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in an environment variable and is used for multiple security-critical operations. When a weak or easily guessable application key i...

Service Worker Detected

This is an informational plugin to inform the user that the scanner has detected the usage of Service Worker on the target web application. No source data...

Sequelize Configuration File Detected

Sequelize is a promise-based Node.js ORM tool for databases engines. Sequelize CLI uses by default a configuration file in 'config' directory to store the environment and database information. By accessing it, an attacker could leverage the vulnerability to gain unauthorized and privileged access...

Nginx 1.5.13 < 1.26.2 Buffer Over-read

According to its Server response header, the installed version of nginx is 1.5.13 to 1.26.2 or 1.27.0. It is, therefore, affected by a security issue was identified in the ngxhttpmp4module, which might allow an attacker to cause a worker process crash by using a specially crafted mp4 file...

Flowise < 2.0.6 Authentication Bypass

Flowise versions prior to 2.0.6 are vulnerable to an authentication bypass allowing a remote and unauthenticated attacker to perform administrative actions through the REST API. No source data...

Ivanti Virtual Traffic Manager Authentication Bypass

Ivanti Virtual Traffic Manager vTM versions before 22.2R1 and 22.x 22.7R2 suffers from an authentication bypass vulnerability. By exploiting this vulnerability, a remote and unauthenticated attacker can access the administration panel and perform arbitrary modifications on the affected instance. ...