Analytics Are Essential for Effective Database Security

We have all heard the saying, “early detection is critical.” This is true in most aspects of our daily lives; in everything from medical diagnosis, automobile issues, a leaky roof, credit card fraud, etc. It should come as no surprise that this is especially true in the context of data security...

Phoronix Test Suite 跨站请求伪造漏洞

Phoronix Test Suite is a Phoronix Test Suite open source, cross-platform automated testing/benchmarking software. Phoronix Test Suite suffers from a cross-site request forgery vulnerability that stems from a WEB application that does not adequately validate that a request is coming from a trusted...

GitLab 跨站脚本漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. GitLab suffers from a cross-site scripting vulnerability that stems from the la...

Reprise Software Reprise License Manager 跨站脚本漏洞

Reprise Software Reprise License Manager is a software licensing toolkit from Reprise Software, Inc. that provides local and cloud-based license management, license enforcement and product activation solutions for publishers of commercial software applications.Reprise Software Reprise License...

GitLab 输入验证错误漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. GitLab suffers from an Input Validation Error vulnerability that stems from th...

Apache JSPWiki < 2.11.0.M4 Multiple Vulnerabilities

Apache JSPWiki is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

ROS-20220112-04

A vulnerability in the Django web application framework is related to excessive data output by the application during the processing error conditions. Exploitation of the vulnerability could allow an attacker acting remotely, to obtain sensitive system information. Django web application framewor...

The vulnerability of the Apache module for web application security enhancement, modsecurity-apache, related to errors in processing JSON objects, allows attackers to cause service failures.

The vulnerability of the Apache module for enhancing web application security, modsecurity-apache, is related to errors in processing JSON objects. Exploiting this vulnerability can allow a malicious actor to perform a denial-of-service attack...

Crater Invoice Crater 代码问题漏洞

Crater Invoice Crater is an open source web and mobile application from Crater Invoice, Inc. for tracking expenses, payments and creating professional invoices and estimates. Crater Invoice crater suffers from a code issue vulnerability that stems from the unrestricted upload of dangerous types o...

Apache Guacamole < 1.4.0 Multiple Vulnerabilities

Apache Guacamole is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability

Document Title: =============== Ametys v4.4.1 CMS - Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2275 Release Date: ============= 2022-01-12 Vulnerability Laboratory ID VL-ID: ==================================== 22...

Discourse < 2.7.13 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

Cross-site Scripting (XSS) - Generic in projectsend/projectsend

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

Sourcecodester Vehicle Service Management System文件上传漏洞（CNVD-2022-09798）

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple web application for automotive repair/service stores or businesses. Sourcecodester Vehicle Service Management System suffers from a file upload vulnerability that can be exploited by attackers to upload...

scratch-svg-renderer cross-site scripting vulnerability

scratch-svg-renderer is a code library used by the Scratch team to convert SVG to DOM elements. scratch-Svg-Renderer suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications, which can be exploited to execute client-si...

Omise: Host Header Injection leads to Open Redirect and Content Spoofing or Text Injection.

Summary: 1. Open Redirection The https://dashboard.omise.co/test/dashboard website is vulnerable to an Open Redirection flaw if the server receives a crafted X-Forwarded-Host header. Description: Open Redirect is a vulnerability in which the attacker manipulates a web page to redirect the users t...

Krisp: Error Page Content Spoofing or Text Injection

Summary: Error Page Content Spoofing or Text Injection in two urls Target: https://download.prelive.krisp.ai/ Target:https://upld.prelive.krisp.ai/ Description: Content spoofing, also referred to as content injection, "arbitrary text injection" or virtual defacement, is an attack targeting a user...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

vuln4japi A vulnerable Java based REST API for demonstrating C...

Cross-Site Request Forgery (CSRF) in liukuo362573/yishaadmin

Description An attacker is able to log out a user if a logged-in user visits the attacker's website. Proof of Concept history.pushState'', '', '/' document.forms0.submit; Impact This vulnerability is capable of forging users to unintentional logout. More details One way GET could be abused here i...

Sourcecodester Vehicle Service Management System Cross-Site Scripting Vulnerability (CNVD-2022-02641)

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple Web application for automotive repair/service stores or businesses. sourcecodester Vehicle Service Management System version 1.0 has a cross-site scripting vulnerability that stems from a lack of effective...