3810 matches found
CVE-2023-39854
CVE-2023-39854 affects ATX Ucrypt 3.5 and earlier. The vulnerability allows authenticated users, or attackers using default admin/master/user credentials, to include files via the /hydra/view/get_cc_url parameter, enabling Server-Side Request Forgery (SSRF). Multiple sources (Red Hat, NVD, CNNVD,...
batik: Server-Side Request Forgery vulnerability
A flaw was found in Apache Batik, where a malicious SVG can probe user profile data and send it directly as parameter to a URL. This issue can allow an attacker to conduct SSRF attacks...
CVE-2023-33273
An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection blind...
CVE-2023-33270
An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection blind...
DTS Monitoring Operating System Command Injection Vulnerability
DTS Monitoring is an information system monitoring platform from DTS Corporation. An operating system command injection vulnerability exists in DTS Monitoring version 3.57.0, which stems from the url parameter in the WGET check function being susceptible to operating system command injection...
CVE-2023-33273: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection blind...
CVE-2023-33270
CVE-2023-33270 affects DTS Monitoring 3.57.0. The issue is a blind OS command injection in the url parameter of the Curl check function, enabling arbitrary command execution with high impact (C/H/I/H) per the CVSS 3.1 vector. Connected sources confirm the vulnerable component and root cause but d...
CVE-2023-43325
A reflected cross-site scripting XSS vulnerability in the dataredirecturl parameter of mooSocial v3.1.8 allows attackers to steal user's session cookies and impersonate their account via a crafted URL...
mooSocial Cross-Site Scripting Vulnerability
mooSocial is a multi-platform, mobile-ready, user-friendly script from mooSocial, Inc. for building community-driven content sharing and social networking sites. A cross-site scripting vulnerability exists in mooSocial version v3.1.8, which stems from the presence of cross-site scripting in the...
CVE-2023-39575
A reflected cross-site scripting XSS vulnerability in the urlstr URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
Cross site scripting
A reflected cross-site scripting XSS vulnerability in the urlstr URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2023-39575
A reflected cross-site scripting XSS vulnerability in the urlstr URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2023-39575
A reflected cross-site scripting XSS vulnerability in the urlstr URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2023-39777
A cross-site scripting XSS vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter...
Siemens RUGGEDCOM ROX Improper Neutralization of Special Elements Used in a Command (CVE-2023-36751)
A vulnerability has been identified in RUGGEDCOM ROX MX5000 All versions V2.16.0, RUGGEDCOM ROX MX5000RE All versions V2.16.0, RUGGEDCOM ROX RX1400 All versions V2.16.0, RUGGEDCOM ROX RX1500 All versions V2.16.0, RUGGEDCOM ROX RX1501 All versions V2.16.0, RUGGEDCOM ROX RX1510 All versions V2.16.0...
CVE-2023-39967 Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified potential attack vectors: via...
Cinema Booking System 1.0 Cross Site Scripting Vulnerability
Title: Cinema Booking System-1.0 XSS-Reflected Author: nu11secur1ty Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/car-rental-script/ Reference: https://portswigger.net/web-security/sql-injection Description: The name of an arbitrarily supplied URL parameter is copied in...
Cinema Booking System 1.0 Cross Site Scripting
Title: Cinema Booking System-1.0 XSS-Reflected Author: nu11secur1ty Date: 09/05/2023 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/car-rental-script/ Reference: https://portswigger.net/web-security/sql-injection Description: The name of an arbitrarily supplied URL...
Plausible Analytics < 1.3.4 - Reflected XSS
Description The plugin does not sanitise and escape the page-url parameter before outputting it back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...