CVE-2024-47883 Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the java.net.URL class to refer to what are expected to be local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local...

CVE-2024-47883 Butterfly has path/URL confusion in resource handling leading to multiple weaknesses

The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the java.net.URL class to refer to what are expected to be local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local...

CVE-2024-47883

The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the java.net.URL class to refer to what are expected to be local resource files, like images or templates. This works: "opening a connection" to these URLs opens the local...

Cisco Issues Urgent Fix for ASA and FTD Software Vulnerability Under Active Attack

Cisco on Wednesday said it has released updates to address an actively exploited security flaw in its Adaptive Security Appliance ASA that could lead to a denial-of-service DoS condition. The vulnerability, tracked as CVE-2024-20481 CVSS score: 5.8, affects the Remote Access VPN RAVPN service of...

PT-2024-16193 · Unknown · Phpgurukul Vehicle Record System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Vehicle Record System version 1.0 Description: A critical issue has been found in the processing of the file /admin/search-vehicle.php. The manipulation of the searchinputdata argument leads to SQL injection. The attack may be...

Money Manager EX WebApp 安全漏洞

Money Manager EX WebApp is an open source personal finance management software from Money Manager EX. A security vulnerability exists in Money Manager EX WebApp version 1.2.2, which stems from an access control error, where the function fails to terminate script execution after redirecting an...

PT-2024-29465 · Unknown · Money Manager Ex Webapp

Name of the Vulnerable Software and Affected Versions: Money Manager EX WebApp versions 1.2.2 Description: The issue is related to Incorrect Access Control. The redirect if not loggedin function in functions security.php fails to terminate script execution after redirecting unauthenticated users...

CVE-2024-49210

Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

CVE-2024-49210

Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web...

CVE-2022-23861: Improper Neutralization of Input During Web Page Generation

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

YSoft SAFEQ 跨站脚本漏洞

YSoft SAFEQ is an enterprise print management suite solution platform from the Czech company YSoft. A security vulnerability exists in YSoft SAFEQ that stems from a lack of output cleanup, resulting in multiple fields in the YSoft SafeQ web application that can be used to inject malicious input...

CVE-2022-23861

Multiple Stored Cross-Site Scripting vulnerabilities were discovered in Y Soft SAFEQ 6 Build 53. Multiple fields in the YSoft SafeQ web application can be used to inject malicious inputs that, due to a lack of output sanitization, result in the execution of arbitrary JS code. These fields can be...

CVE-2024-49211

Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web...

CVE-2024-49211

Reflected XSS was discovered in a Dashboard Listing Archer Platform UX page in Archer Platform 6.x before version 2024.08. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web...

CVE-2024-49210

Summary: CVE-2024-49210 describes a reflected XSS in Archer Platform 6.x (prior to 2024.09) via the iView List Archer Platform UX page. An unauthenticated remote attacker could entice a user to submit malicious HTML/JavaScript, which is then reflected and executed in the victim’s browser within t...

CVE-2024-49211

CVE-2024-49211 describes a Reflected XSS in the Dashboard Listing Archer Platform UX page for Archer Platform 6.x before 2024.08 . The vulnerability allows a remote, unauthenticated attacker to lure a victim user into submitting malicious HTML/JavaScript, which is then reflected and executed in t...

CVE-2024-49210

Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web...

CVE-2024-49210: Improper Neutralization of Input During Web Page Generation

Reflected XSS was discovered in an iView List Archer Platform UX page in Archer Platform 6.x before version 2024.09. A remote unauthenticated attacker could potentially exploit this by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web...