1024 matches found
Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG
The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads As an author or above, upload the below SVG file via the Media library: alert/XSS/; The XSS will be triggered when accessing the file directly, e...
GHSA-2JXH-3CX8-XW65 Apache Geronimo console 1.0 vulnerable to cross-site scripting
Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer. Version 1.1 contai...
Apache Geronimo console 1.0 vulnerable to cross-site scripting
Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer. Version 1.1 contai...
Apache Log4j 安全漏洞
Apache Log4j is a Java-based open source logging tool from the Apache Foundation. Amazon Linux log4j-cve-2021-44228-hotpatch version 1.1-12 previously had a security vulnerability that stemmed from the Apache Log4j hotpatch package prior to log4j-cve-2021-44228-hotpatch-1.1-12 not mimicking the...
CVE-2021-43700
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
CVE-2021-43700
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8...
gongwalker ApiManager SQL注入漏洞
gongwalker ApiManager is an interface documentation management tool for individual developers of gongwalker. A security vulnerability exists in gongwalker ApiManager 1.1, which can be exploited by attackers via /index.php?act=api&tag=8...
WordPress Petfinder Listings plugin <= 1.0.19 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress Petfinder Listings plugin versions = 1.0.19. Solution Update the WordPress Petfinder Listings plugin to the latest available version at least 1.1...
GHSA-6G5F-F5PM-MJRG Istio may not check inbound TCP connections against istio-policy
Istio 1.1.x through 1.1.6 has Incorrect Access Control. When disablePolicyChecks is set to false, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied. This behavior is a result of a change to...
PT-2022-17149 · Jenkins · Jenkins Convertigo Mobile Platform Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Convertigo Mobile Platform Plugin versions 1.1 and earlier Description: The issue allows attackers with Item/Configure permission to capture passwords of jobs that will be configured, due to the use of static fields to store job...
PT-2022-17129 · Jenkins · Jenkins Custom Checkbox Parameter Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Custom Checkbox Parameter Plugin versions 1.1 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability. This is due to the plugin not escaping parameter names of custom checkbox parameters. Attacke...
CVE-2022-21711 Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.
elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special...
CVE-2022-21711 Out-of-bounds Read lead to application crashes or information leakage in ELF parsing.
elfspirit is an ELF static analysis and injection framework that parses, manipulates, and camouflages ELF files. When analyzing the ELF file format in versions prior to 1.1, there is an out-of-bounds read bug, which can lead to application crashes or information leakage. By constructing a special...
T-Reqs-HTTP-Fuzzer - A Grammar-Based HTTP Fuzzer
T-Reqs T wo Req uests is a grammar-based HTTP Fuzzer written as a part of the paper titled "T-Reqs: HTTP Request Smuggling with Differential Fuzzing" which was presented at ACM CCS 2021. BibTeX of the paper: @inproceedingsccs2021treqs, title=T-Reqs: HTTP Request Smuggling with Differential Fuzzin...
PT-2022-10752 · Softvibe · Softvibe Saraban For Infoma
Name of the Vulnerable Software and Affected Versions: SoftVibe SARABAN for INFOMA version 1.1 Description: The issue allows SQL Injection. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited...
Bottelet Daybyday Crm 跨站脚本漏洞
Bottelet Daybyday Crm is a builder system for task, time, employee, and vacation management by Bottelet Individual Developers. Bottelet DayByDay CRM suffers from a cross-site scripting vulnerability that stems from an application-wide Client-Side Template Injection CSTI suffered in DayByDay CRM,...
GHSA-96V6-HRWG-P378 Weak Password Requirements in Daybyday CRM
In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users’...
DELL Wyse Management Suite Encryption Issue Vulnerability
DELL Wyse Management Suite is Dell's hybrid cloud security management solution for Wyse thin client devices, designed to simplify IT management processes and enhance device security. DELL Wyse Management Suite has an encryption issue vulnerability that stems from the program's support for the...
PT-2021-23822 · Unknown · Meddata Hbys
Name of the Vulnerable Software and Affected Versions: MedData HBYS versions prior to 1.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: For...
