WordPress plugin Infusionsoft Web Form JavaScript 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

D-Link DIR-605L formSetWanPPTP Function Buffer Overflow Vulnerability

The D-Link DIR-605L is the first cloud router from AUO, aimed at home and small office network environments. The D-Link DIR-605L suffers from a buffer overflow vulnerability that originates from the webpage parameter of the formSetWanPPTP function in the /goform/formSetWanPPTP page that fails to...

DrayTek Vigor3910 安全漏洞

The DrayTek Vigor 3910 is a high-performance router for enterprise networks from China DrayTek. A security vulnerability exists in the DrayTek Vigor3910 version 4.3.2.6 and prior versions, which stems from improper retrieval and handling of CGI form parameters...

Simple Mail Transfer Pirates: How threat actors are abusing third-party infrastructure to send spam

Attackers are abusing normal features of legitimate web sites to transmit spam, such as the traditional method of verifying the creation of a new account. This web infrastructure and its associated email infrastructure is otherwise used for legitimate purposes, which makes blocking these messages...

CVE-2024-45625

Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator...

CVE-2024-45625

CVE-2024-45625 affects Forminator Forms v1.34.0 and earlier. The issue is a cross-site scripting vulnerability (CWE-79) in the way URLs embedded in a Forminator form can cause arbitrary script execution in the user’s browser when a crafted URL is accessed. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI...

PT-2024-38221 · Unknown · Connx Esp Hr Management

Name of the Vulnerable Software and Affected Versions: ConnX ESP HR Management versions prior to 6.6 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation vulnerability in the "Update of Personal Details" form, allowing a Stored XSS attack. An attacke...

silverstripe/framework sends passwords back to browsers under some circumstances

Under some circumstances a form may populate a PasswordField with submitted data, reflecting submitted data back to a user. The user will only see their own submissions for password data, which is not considered best practice. We are not aware of data leaks to other users, devices or sessions...

D-Link DIR-619 安全漏洞

The D-Link DIR-619L is a wireless router designed for home and small office environments, utilizing the IEEE 802.11n standard with a maximum transmission rate of 300Mbps. The D-Link DIR-619L suffers from a buffer overflow vulnerability that originates from the parameter webpage of goform/formWPS...

Sailthru Triggermail <= 1.1 - Reflected XSS

Description The plugin does not sanitise and escape various parameters before outputting them back in pages and attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open: alert23' /...

U.S. Dept Of Defense: SQL injection on ██████████ via 'where' parameter

An SQL injection vulnerability was discovered in the 'where' parameter of the ArcGIS server. The vulnerability allowed an attacker to retrieve database content by injecting malicious SQL queries into the 'where' parameter. Esri released an update to ArcGIS Server 10.1 Service Pack 1 to address th...

The vulnerability of the ftpservlet component of the FileCatalyst Workflow software allows a perpetrator to execute arbitrary code.

The vulnerability of the ftpservlet component in the FileCatalyst Workflow software lies in errors during the processing of HTTP POST requests. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading specially crafted JSP files remotely...

PHP MySQL User Signup Login System SQL Injection Vulnerability

PHP MySQL User Signup Login System is a login and registration form using HTML, PHP and MySQL. A SQL injection vulnerability exists in PHP MySQL User Signup Login System version 1.0, which originates from a SQL injection vulnerability in the file /edit.php...

CVE-2024-24819

icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class gipfl\Web\Form is the base for various concrete form implementations 1 and provides protection against cross site request forgery CSRF by default. This is done by automatically...

PT-2024-20585 · Unknown · Icingaweb2-Module-Incubator

Name of the Vulnerable Software and Affected Versions: icingaweb2-module-incubator versions prior to 0.22.0 Description: The issue concerns the class gipflWebForm, which is the base for various concrete form implementations and provides protection against cross-site request forgery CSRF by defaul...

PT-2023-7731 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form...

Important: golang

Issue Overview: The ScalarMult and ScalarBaseMult methods of the P256 Curve may return an incorrect result if called with some specific unreduced scalars a scalar larger than the order of the curve. This does not impact usages of crypto/ecdsa or crypto/ecdh. CVE-2023-24532 HTTP and MIME header...

OESA-2023-1621 php security update

PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is...

Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin 1. Create a "Service" and a "Provider" under the "gAppointments" sidebar menu. 2. Create a new form within Gravity...

CVE-2023-34831

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...