Cross site scripting

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

Cross site scripting

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

Cross site scripting

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

CVE-2023-40143 Westermo Lynx

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

CVE-2023-40143

CVE-2023-40143 affects Westermo Lynx web interface. A cross-site scripting flaw allows an attacker who can access the Lynx web application to inject arbitrary JavaScript via the forward.0.domain parameter. Public sources (NVD/Nessus plugin) assign CVSS v3.1 base score 5.4 (Network, Low attack com...

CVE-2023-45222 Westermo Lynx Cross-site Scripting

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

CVE-2023-45222 Westermo Lynx Cross-site Scripting

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

CVE-2023-45222

CVE-2023-45222 affects the Westermo Lynx 206-F2G web interface (WeOS) where an attacker with access to the web app can inject arbitrary JavaScript via the autorefresh parameter (Cross-Site Scripting, CWE-79). Public disclosures (NVD/NIST, Tenable OT plugin, CNVD, PRION, CVE list) describe identic...

CVE-2023-45227 Westermo Lynx Cross-site Scripting

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

CVE-2023-45227

Westermo Lynx 206-F2G (WeOS) CVE-2023-45227 is a Cross-Site Scripting vulnerability due to improper input neutralization in the web page generation for the dns.0.server parameter (CWE-79). An attacker with access to the vulnerable web application could inject arbitrary JavaScript, with the issue ...

CVE-2023-45227 Westermo Lynx Cross-site Scripting

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

PT-2024-13234 · Westermo · Lynx +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the autorefresh...

PT-2024-12856 · Westermo · Westermo Lynx

Name of the Vulnerable Software and Affected Versions: Westermo Lynx affected versions not specified Description: An attacker with access to the Westermo Lynx web application could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the forward.0.domain parameter...

PT-2024-13236 · Westermo · Lynx +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the dns.0.server parameter...

The vulnerability of the ModSecurity security module for protecting web applications arises from insufficient validation of input data. This allows attackers to bypass the WAF rules.

The vulnerability of the ModSecurity security module for protecting web applications exists due to insufficient validation of input data when processing URL addresses. Exploiting this vulnerability can allow a malicious actor to bypass WAF rules...

CVE-2024-24574

CVE-2024-24574 affects phpMyFAQ; unsafe echo of the filename in phpMyFAQ/phpmyfaq/admin/attachments.php enables a stored XSS (client-side JavaScript execution). The vulnerability has been patched in version 3.2.5. Affected description and references from multiple sources (NVD, Red Hat, GHSA) conf...

CVE-2024-22208

CVE-2024-22208 affects phpMyFAQ, where the front-end sharing feature allows unauthenticated users to email multiple recipients (the UI supports 5 addresses) and, due to backend lack of enforcement, can be abused to send thousands of phishing emails via the app’s mail server. The issue stems from ...

CVE-2024-22202

phpMyFAQ contains a vulnerability in the user removal page that lets an attacker spoof another user’s details and trigger phishing-style account deletion emails to administrators. The issue arises because the front-end does not enforce data integrity on the removal request, enabling an attacker (...

CVE-2024-22202 User Removal Page Allows Spoofing Of User Details

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows an attacker to spoof another user's detail, and in turn make a compelling phishing case for removing another user's account. The front-end of this page doesn'...

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) may be vulnerable to HTTP request smuggling (CVE-2023-46589)

Summary Due to the use of Apache Tomcat, IBM DevOps Deploy / IBM UrbanCode Deploy UCD is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP trailer headers. By sending a specially crafted HTTPS trailer header, an attacker could exploit this vulnerability to poison the we...