Lucene search
+L

803 matches found

zdt
zdt
•added 2021/10/13 12:00 a.m.•352 views

myfactory.FMS 7.1-911 Cross Site Scripting Vulnerability

Cross-Site Scripting in myfactory.FMS During a penetration test, a reflected cross-site scripting vulnerability XSS was found in the myfactory.FMS login form. If a user opens an attacker-prepared link to the application, attackers can run arbitrary JavaScript code in the user's browser. Details...

6.1CVSS6.3AI score0.05832EPSS
SaveExploits4
UbuntuCve
UbuntuCve
•added 2021/10/04 5:15 p.m.•37 views

CVE-2021-39899

In all versions of GitLab CE/EE, an attacker with physical access to a user’s machine may brute force the user’s password via the change password function. There is a rate limit in place, but the attack may still be conducted by stealing the session id from the physical compromise of the account...

4.2CVSS5.9AI score0.00257EPSS
SaveExploits0References3
Huntr
Huntr
•added 2021/09/12 11:23 p.m.•12 views

Cross-Site Request Forgery (CSRF) in justingit/dada-mail

✍️ Description Attacker able to Send any Mass mailing with CSRF attack. In CSRF attacks it is necessary that a user logged into your application and just going to a malicious website and after that only with a redirection attacker can perform attack on unprotected endpoint, this means only with...

1.2AI score
SaveExploits0
Hacker One
Hacker One
•added 2021/08/27 4:05 a.m.•62 views

Courier: [3] Bypassing IP Based Rate Limit Blocking leads to rate limit bypass in Courier Login Panel

Hi team, I would like to report rate limit issue based on IP blocking mechanism. Rate-limitation nowadays is not effective anymore to protect against brute-force. There are many botnets out there which can be used to overcome this hurdle, as well as cloud VPS services e.g. Amazon AWS EIPs, Digita...

0.2AI score
SaveExploits0
Cvelist
Cvelist
•added 2021/08/24 6:49 p.m.•46 views

CVE-2021-30896

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, tvOS 15.1, watchOS 8.1, macOS Monterey 12.0.1. A malicious application may be able to read user's gameplay data...

5.7AI score0.00884EPSS
SaveExploits0References4
Huntr
Huntr
•added 2021/08/23 11:31 a.m.•15 views

Cross-site Scripting (XSS) - Reflected in znixbtw/panel-v2

✍️ Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into websites. An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will...

5.4AI score
SaveExploits0References2
wpexploit
wpexploit
•added 2021/08/23 12:00 a.m.•827 views

Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure

The plugin outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts capability. Combined with the other Unauthorised Event...

6.5CVSS0.01177EPSS
SaveExploits2
WPVulnDB
WPVulnDB
•added 2021/08/23 12:00 a.m.•24 views

Timetable and Event Schedule by MotoPress < 2.4.0 - Arbitrary User's Hashed Password/Email/Username Disclosure

The plugin outputs the Hashed Password, Username and Email Address along other less sensitive data of the user related to the Even Head of the Timeslot in the response when requesting the event Timeslot data with a user with the editposts capability. Combined with the other Unauthorised Event...

6.5CVSS0.2AI score0.01177EPSS
SaveExploits2Affected Software1
Huntr
Huntr
•added 2021/08/10 8:50 a.m.•14 views

Cross-site Scripting (XSS) - Reflected in erudika/scoold

✍️ Description It occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user's browser. 🕵️‍♂️ Proof of Concept...

0.7AI score
SaveExploits0References1
CNVD
CNVD
•added 2021/08/05 12:00 a.m.•67 views

Fortinet FortiSandbox Cross-Site Scripting Vulnerability

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet, Inc. The appliance provides dual sandboxing technology, a dynamic threat intelligence system, a real-time control panel and reporting, etc. The Fortinet FortiSandbox contains a cross-site scripting...

6.1CVSS1.2AI score0.00614EPSS
SaveExploits0References1
OSV
OSV
•added 2021/08/03 7:15 p.m.•25 views

CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset tok...

7.5CVSS7.1AI score
SaveExploits0References2
NVD
NVD
•added 2021/08/03 7:15 p.m.•30 views

CVE-2021-33322

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 18, and 7.2 before fix pack 5, password reset tokens are not invalidated after a user changes their password, which allows remote attackers to change the user’s password via the old password reset tok...

7.5CVSS0.01202EPSS
SaveExploits0References2
Veracode
Veracode
•added 2021/07/13 6:57 a.m.•21 views

Cross-Site Scripting (XSS)

servicestack is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via a malicious URL to the application...

6.1CVSS4.6AI score0.00889EPSS
SaveExploits0References1Affected Software1
Veracode
Veracode
•added 2021/06/21 5:05 a.m.•25 views

Cross-Site Scripting (XSS)

striptags is vulnerable to cross-site scripting XSS. A type-confusion vulnerability occurs when concatenating unsanitized strings when an array-like object is passed in as the html parameter. An attacker who is able to control the shape of their input can abuse this behavior to inject and execute...

5.3CVSS2.9AI score0.01079EPSS
SaveExploits0References4Affected Software1
CNVD
CNVD
•added 2021/06/12 12:00 a.m.•21 views

Stored XSS Vulnerability in the Open Source Version of Mad God's Little Community

Mad God's small community open source version is a Springboot-based open source community management system . Mad God's small community open source version of the existence of stored XSS vulnerability , an attacker can use the vulnerability to obtain the user's cookie information...

5.6AI score
SaveExploits0
Hacker One
Hacker One
•added 2021/06/09 7:18 p.m.•34 views

Meredith: Shop - Reflected XSS With Clickjacking Leads to Steal User's Cookie In Two Domain

Hii Security Team , I am S Rahul MCEHMetaxone Certified Ethical Hacker and a Security Researcher I just checked your website and found Reflected XSS to Good XSS Clickjacking In Two Domain Description:- As the search parameter is vulnerable to XSS and but the plus point is there is no...

6.4AI score
SaveExploits0
Veracode
Veracode
•added 2021/06/09 2:36 a.m.•28 views

Cross-site Scripting (XSS)

datasette is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the ?trace=1 debugging feature...

7.2CVSS3.9AI score0.0096EPSS
SaveExploits0References7Affected Software1
NVD
NVD
•added 2021/06/08 1:15 p.m.•34 views

CVE-2020-26515

An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie CBLOGIN issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a...

7.5CVSS0.00514EPSS
SaveExploits1References2
NVD
NVD
•added 2021/05/27 7:15 p.m.•22 views

CVE-2021-33394

Cubecart 6.4.2 allows Session Fixation. The application does not generate a new session cookie after the user is logged in. A malicious user is able to create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker...

5.5CVSS0.00696EPSS
SaveExploits1References2
Hacker One
Hacker One
•added 2021/05/14 4:39 a.m.•31 views

U.S. Dept Of Defense: IDOR while uploading ████ attachments at [█████████]

Description: There is an IDOR vulnerability in uploading attachments to the ████ section where an attacker can upload attachments in other user's █████████ if there is no attachment uploaded by a user. If this vulnerability will be used with a Race condition, it can allow an attacker to upload...

1.1AI score
SaveExploits0
Rows per page
Query Builder