15860 matches found
F5 BIG-IP Security Vulnerabilities
F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, and load balancing from F5 USA. A security vulnerability exists in F5 BIG-IP that originates when configuring BIG-IP ASM/Advanced WAF security policy on a virtual server, whe...
Hardy Barth eCharge Command Injection
The vulnerability of the Hardy Barth eCharge charging station’s web application exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially...
XWiki Platform Cookie Access
The vulnerability of the XWiki Platform lies in the insufficient verification of incoming requests. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to cookies files...
CVE-2024-22129
SAP Companion - version 3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application...
Design/Logic Flaw
SAP Companion - version 3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application...
CVE-2024-22129 Cross-Site Scripting (XSS) vulnerability in SAP Companion
SAP Companion - version 3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application...
CVE-2024-22129 Cross-Site Scripting (XSS) vulnerability in SAP Companion
SAP Companion - version 3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application...
Simple Customer Relationship Management System Login Component SQL Injection
The vulnerability of the php-scrm/login.php component in the Simple Customer Relationship Management System web application is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries against the databa...
Icinga Web 2 Cross-Site Request Forgery Vulnerability
Icinga Web 2 is a software application.Icinga Web 2 is the next generation open source monitoring web interface, framework and command line interface developed by the Icinga Project to support Icinga 2, Icinga Core and any other IDO database compatible monitoring backend. Icinga Web 2 suffers fro...
CVE-2024-24014
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list...
Number withdrawn
SourceCodester Employee Management System is a php-based website builder for employee performance management from SourceCodester, USA. The CVE number has been withdrawn...
CVE-2024-24812
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...
Cross site scripting
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...
CVE-2024-24812
CVE-2024-24812 affects the Frappe framework. The vulnerability is a portal-page Cross-Site Scripting (XSS) issue that could allow injection of malicious JavaScript when a user clicks a crafted link. Public sources confirm the issue is in Frappe versions prior to 14.59.0 and 15.5.0 and that it has...
CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...
CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages
Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...
CVE-2024-0628
CVE-2024-0628 affects the WordPress WP RSS Aggregator plugin. The vulnerability is a Server-Side Request Forgery (SSRF) in all versions up to and including 4.23.5, exploitable by authenticated attackers with administrator-level access to issue web requests from the application (via the RSS feed s...
CVE-2024-0628
The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in admin settings. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...
Fortinet FortiWeb Log injection (FG-IR-23-256)
The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-256 advisory. - An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5...