7338 matches found
Cross-site Scripting (XSS)
com.liferay.login.web is vulnerable to cross-site scripting XSS. The vulnerability exists as it does not properly escape the values upe.regex, authType, login, userEmailAddress, userPassword, userEmailAddress, and emailAddress in multiple locations...
The implementation of the getACL() command in the centralized service for managing configuration information, naming, distributed synchronization, and providing group services in Apache ZooKeeper is vulnerable. This vulnerability allows attackers to exploit certain hash function values.
The vulnerability of the getACL function in the centralized service for managing configuration information, naming, distributed synchronization, and providing group services in Apache ZooKeeper is related to permission handling errors. Exploiting this vulnerability can allow an attacker to exploi...
Integer overflow
plxelf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PTDYNAMIC segment...
Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass Vulnerability
Exploit for multiple platform in category web applications Exploit Title : Crystal Shard http-protection 0.2.0 - IP Spoofing Bypass Exploit Author : Halis Duraki @0xduraki Product : http-protection Crystal Shard Product URI : https://github.com/rogeriozambon/http-protection Version :...
Dynamic Data Resolver (DDR) — IDA Plugin 1.0 beta
By Holger Unterbrink Executive summaryStatic reverse-engineering in IDA can often be problematic. Certain values are calculated at run time, which makes it difficult to understand what a certain basic block is doing. If you try to perform dynamic analysis by debugging a piece of malware, the...
Cross-site Scripting (XSS)
forkcms/forkcms is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape the data values provided by the user such as navigationtitle and pageTitle in the function createHtml, allowing a malicious user to inject and execute malicious web script...
CVE-2020-13429
legend.ts in the piechart-panel aka Pie Chart Panel plugin before 1.5.0 for Grafana allows XSS via the Values Header aka legend header option...
CVE-2020-13429
legend.ts in the piechart-panel aka Pie Chart Panel plugin before 1.5.0 for Grafana allows XSS via the Values Header aka legend header option...
Cross site scripting
legend.ts in the piechart-panel aka Pie Chart Panel plugin before 1.5.0 for Grafana allows XSS via the Values Header aka legend header option...
UBUNTU-CVE-2020-13430
Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource...
CVE-2020-13429
legend.ts in the piechart-panel aka Pie Chart Panel plugin before 1.5.0 for Grafana allows XSS via the Values Header aka legend header option...
CVE-2020-1084
A Denial Of Service vulnerability exists when Connected User Experiences and Telemetry Service fails to validate certain function values.An attacker who successfully exploited this vulnerability could deny dependent security feature functionality.To exploit this vulnerability, an attacker would...
CVE-2020-13146
Studio in Open edX Ironwood 2.5 allows CSV injection because an added cohort in CourseInstructorCohorts may contain a formula that is exported via the "CourseData DownloadsReportsDownload profile info" feature...
CVE-2020-12857
Caching of GATT characteristic values TempID in COVIDSafe v1.0.15 and v1.0.16 allows a remote attacker to long-term re-identify an Android device running COVIDSafe...
CVE-2020-12857
CVE-2020-12857 concerns the COVIDSafe Android app, where caching of GATT characteristic values (TempID) in versions 1.0.15 and 1.0.16 allows a remote attacker to long-term re-identify an affected device. The Red Hat, NVD and CVE listings align on the impact: exposure of re-identification risk due...
Spring Security Security Feature Issue Vulnerability
Spring Security, formerly known as Acegi Security , is a framework used by the Spring project team to provide secure authentication services. A security signature issue vulnerability exists in Spring Security. An attacker can exploit this vulnerability to obtain unencrypted values with the help o...
Open redirect
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting ...
CVE-2020-10612
Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicates with SoftPACMonitor over network Port 22000. However, this port is open without any restrictions. This allows an attacker with network access to control the SoftPACAgent service including updating SoftPAC firmware, starting ...
TYPO3 Direct Mail Component Information Disclosure Vulnerability (CNVD-2020-28942)
TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A security vulnerability exists in the Direct Mail component of TYPO3 5.2.3 and prior versions, which originates from the program's inability to check whether an authenticated back-end user...
jewishvaluesonline.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1159510 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...