1752 matches found
CVE-2024-47590 Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the victim's browser XXS or transmitted to...
BlackBerry SecuSUITE 安全漏洞
BlackBerry SecuSUITE is a multi-platform solution for end-to-end encryption of voice calls and messages from BlackBerry Canada. A security vulnerability exists in BlackBerry SecuSUITE version 5.0.420 and earlier, which stems from the presence of an Entropy Insufficiency Vulnerability that could...
CVE-2024-49524
CVE-2024-49524 affects Adobe Experience Manager versions 6.5.20 and earlier, with a DOM-based Cross-Site Scripting (XSS) vulnerability. By manipulating a DOM element through a crafted URL or user input, an attacker can inject scripts that execute in the victim’s browser context. Exploitation typi...
Linux-pam 安全漏洞
Linux-pam is a pluggable-supported system authentication software for Linux from the Linux team. A security vulnerability exists in Linux-pam, which stems from confidential information stored in memory that can trigger execution of a victim program by sending characters to its standard input stdi...
DEBIAN-CVE-2024-22034
Attackers could put the special files in .osc into the actual package sources e.g. apiurl. This allows the attacker to change the configuration of osc for the victim...
CVE-2024-22034
Attackers could put the special files in .osc into the actual package sources e.g. apiurl. This allows the attacker to change the configuration of osc for the victim...
CVE-2023-32192
A vulnerability has been identified in which unauthenticated cross-site scripting XSS in the API Server's public API endpoint can be exploited, allowing an attacker to execute arbitrary JavaScript code in the victim browser...
webkitgtk: A malicious website may exfiltrate data cross-origin
A vulnerability was found in WebKit. This flaw allows a remote attacker to exfiltrate data cross-origin by convincing a victim to visit a specially crafted website, which results in obtaining sensitive information...
webkit: maliciously crafted webpage may be able to fingerprint the user
A flaw was found in WebKit. This flaw allows remote attackers to bypass security restrictions through an injection issue by persuading a victim to access a specially crafted website, enabling the attackers to fingerprint the user...
Rancher API Server 安全漏洞
Rancher API Server is an interface between an HTTP client and more sophisticated applications in the Rancher open source. A security vulnerability exists in Rancher API Server that stems from the presence of cross-site scripting XSS that allows an attacker to execute arbitrary JavaScript code in...
CVE-2024-45152 Substance3D - Stager | Out-of-bounds Write (CWE-787)
Substance3D - Stager versions 3.0.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...
PHP-Nuke Top Module SQL Injection
Exploit Title: PHP-Nuke SQL injection Top Module + protection Bypass Google Dork: intext: Powered by PHP-Nuke Date: 2024-10-07 Exploit Author: Emiliano Febbi Vendor Homepage: https://phpnuke.org/ Software Link: https://sourceforge.net/projects/phpnuke/files/phpnuke/ Version: 6.x New concept of...
CVE-2024-25691
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 11.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser...
Esri Portal For ArcGIS 跨站脚本漏洞
Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. Esri Portal For ArcGIS suffers from a cross-site scripting vulnerability that can be...
Esri Portal For ArcGIS 跨站脚本漏洞
Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. Esri Portal For ArcGIS suffers from a cross-site scripting vulnerability that can be...
containers/image: digest type does not guarantee valid type
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...
Threat actor believed to be spreading new MedusaLocker variant since 2022
Cisco Talos has discovered a financially motivated threat actor, active since 2022, recently observed delivering a MedusaLocker ransomware variant. Intelligence collected by Talos on tools regularly employed by the threat actor allows us to see an estimate of the amount and countries of origin of...
containers/image: digest type does not guarantee valid type
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks...
CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...
CVE-2023-7273 Cross Site Request Forgery in Kiteworks OwnCloud
Cross site request forgery in Kiteworks OwnCloud allows an unauthenticated attacker to forge requests. If a request has no Authorization header, it is created with an empty string as value by a rewrite rule. The CSRF check is done by comparing the header value to null, meaning that the existing...