14939 matches found
CVE-2024-31213 InstantCMS Open Redirect vulnerability
InstantCMS is a free and open source content management system. An open redirect was found in the ICMS2 application version 2.16.2 when being redirected after modifying one's own user profile. An attacker could trick a victim into visiting their web application, thinking they are still present on...
CVE-2024-31213
CVE-2024-31213 describes an open redirect in InstantCMS ICMS2 (version 2.16.2) occurring after a user modifies their profile. An attacker could lure a victim to visit a malicious site that imitates the ICMS2 flow and prompts for the user’s password, which could be sent to the attacker. The CVE no...
The vulnerability of the Mastodon web application for deploying distributed social networks relates to the incorrect expiration time of the session, allowing an intruder to gain unauthorized access to protected information.
The vulnerability of the Mastodon web application for deploying distributed social networks is related to an incorrect session duration. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
webapp.ltu.se Cross Site Scripting vulnerability OBB-3903025
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
acc-collision.com Cross Site Scripting vulnerability OBB-3901327
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Builderall Builder for WordPress < 2.0.2 - Unauthenticated Server-Side Request Forgery
Description The Builderall Builder for WordPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.0.1. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application whi...
CMP – Coming Soon & Maintenance < 4.1.11 - Authenticated (Admin+) Server-Side Request Forgery
Description The CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.1.10. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests...
User Registration And Login And User Management System 3.2 SQL Injection
Exploit Title: User Registration & Login and User Management System v3.2 - SQL Injection Unauthenticated Exploit Author: Yusuf DİNÇ Google Dork: NA Date: 05/03/2024 Vendor Homepage: https://phpgurukul.com Software Link:...
Westermo MRD-315 ASP Source Code Disclosure (CVE-2020-7227)
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.as...
Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-45227)
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'dns.0.server' parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...
Cisco Identity Services Engine 安全漏洞
Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. The Cisco Identity Services Engine suffers from...
The vulnerability of Thales Imperva SecureSphere’s microprogramming software, related to access control deficiencies, allows a intruder to bypass network firewall rules and inject specially crafted POST requests into the protected web application.
The vulnerability of Thales Imperva SecureSphere’s microprogrammed network firewall software is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to bypass network firewall rules and inject specially crafted POST requests into the network...
Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-45222)
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'autorefresh' parameter. This plugin only works with Tenable.ot. Please visit...
Westermo Lynx 206-F2G Improper Neutralization of Input During Web Page Generation (CVE-2023-40143)
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the 'forward.0.domain' parameter. This plugin only works with Tenable.ot. Please visit...
Vul
This is a PoC exploit for an unspecified vulnerability in an uns...
The vulnerability of the Java-based web application framework Apache Wicket, related to the manipulation of cross-site requests, allows a hacker to perform a CSRF attack.
The vulnerability of the Java-based web application framework Apache Wicket relates to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack using a specially created web page...
Daily Habit Tracker 1.0 - Broken Access Control Vulnerability
Exploit Title: Daily Habit Tracker 1.0 - Broken Access Control Exploit Author: Yevhenii Butenko Vendor Homepage: https://www.sourcecodester.com Software Link: https://www.sourcecodester.com/php/17118/daily-habit-tracker-using-php-and-mysql-source-code.html Version: 1.0 Tested on: Debian CVE :...
The vulnerability of the /index.php?page=search component of the web application used to manage assets in RackTables allows a attacker to disclose sensitive information.
The vulnerability of the /index.php?page=search component of the web application used to manage RackTable assets exists due to the lack of security measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor to disclose sensitive informatio...
ROS-20240402-15
A vulnerability in the virtuoso-opensource web application development platform is related to the invocation of a denial of Denial of Service DoS using specially crafted SQL statements. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service A...
