多款 Cisco 产品安全漏洞

Cisco Email Security Appliance ESA and so on are products of Cisco USA.Cisco Email Security Appliance is an email security appliance.Cisco Web Security Appliance WSA is a Web Security Appliance.Cisco Secure Email is A security vulnerability exists in the Cisco Email Security Appliance ESA, Cisco...

Cisco Web Security Appliance 输入验证错误漏洞

The Cisco Web Security Appliance WSA is a web security appliance from Cisco USA. The appliance provides SaaS-based access control, real-time web reporting and tracking, and development of security policies. The Cisco Web Security Appliance WSA suffers from an input validation error vulnerability...

hennecken-krings.de Cross Site Scripting vulnerability OBB-2466497

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat...

CVE-2021-32503

CVE-2021-32503 affects SICK FTMg/FieldEcho devices where an unauthenticated user can access sensitive web URLs via a GET request, potentially enabling further attacks. Public exploit details are not provided; SICK PSIRT notes no known public exploits and has released firmware fixes, recommending ...

CVE-2022-26565

Totaljs XSS (CVE-2022-26565): all versions prior to commit 95f54a5commit are vulnerable. An attacker can inject a crafted payload into the Page Name text field during page creation to execute arbitrary web scripts or HTML. The vulnerability is due to unsanitized input in the Page Name field, enab...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit allows attackers to compromise data integrity.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to compromise the integrity of data...

All Vulnerabilities for tributos.alagoinhas.ba.gov.br Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| tributos.alagoinhas.ba.gov.br ---|---...

web.petropolis.rj.gov.br Cross Site Scripting vulnerability OBB-2457073

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2022-2257 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 14.4 through 14.7.6 GitLab CE/EE versions 14.8 through 14.8.4 GitLab CE/EE versions 14.9 through 14.9.1 Description: The issue is related to the lack of protection of the web page structure, allowing for remote attackers...

One Church Management System 1.0 SQL Injection Vulnerability

Exploit Title: One Church Management System 1.0 - attendancy.php search2 SQL Injection Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15225/church-management-software-free-download-full-version.html Version: 1.0 Tested on: Linux Title: ================ One Church...

dandiwibowo.web.id Cross Site Scripting vulnerability OBB-2448210

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-25582

CVE-2022-25582 describes a stored cross-site scripting (XSS) vulnerability in the ClassCMS Column module, affecting v2.5 and earlier. The root cause is insufficient validation/filtering of user-supplied data in the Add Articles field, allowing an attacker to inject arbitrary script or HTML that i...

CVE-2022-25574

CVE-2022-25574 describes a stored XSS in the upload function /admin/show.php, affecting DouPHP (and related DouPhp/DouShell references in the connected entries). The root cause is insufficient input validation/escaping in the image upload pathway, allowing crafted image files to execute arbitrary...

CVE-2022-26285

CVE-2022-26285 affects Simple Subscription Website v1.0. A SQL injection flaw exists in the apply endpoint’s id parameter, allowing an attacker to dump the database via crafted HTTP requests. Connected sources (NVD/Red Hat/CNVD/CVE records) confirm the vulnerable endpoint and impact. The document...

CVE-2022-26555

CVE-2022-26555 is a stored XSS vulnerability in the Add a Button function of Eova v1.6.0 . The issue allows an attacker to inject arbitrary JavaScript/HTML via the button name text box, enabling script execution in the victim’s browser. Connected sources (Red Hat, NVD, CVE lists) confirm the same...

CVE-2022-25464

CVE-2022-25464 is a stored XSS vulnerability in DoraCMS v2.1.8 affecting the component /admin/contenttemp. The issue allows an attacker to inject arbitrary scripts/HTML via a crafted payload. Public details place CVSSv3.1 base score at 4.8 (MEDIUM) with network access, low attack complexity, user...

Path Traversal due to `send_file` call

A path traversal attack also known as directory traversal aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash ../” sequences and its variations or by using absolute file paths, it may be possible to...

XML external entity (XXE) injection in Apache Nutch

An XML external entity XXE injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions 1.18. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. ...

GHSA-FXHP-WRW9-3R97 XML external entity (XXE) injection in Apache Nutch

An XML external entity XXE injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions 1.18. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. ...