Mageia: Security Advisory (MGASA-2018-0213)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2021-44120

SPIP 4.0.0 is affected by a Cross Site Scripting XSS vulnerability in ecrire/public/interfaces.php, adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available, when a user goes to the public site...

LearnPress < 4.1.5 - Arbitrary Image Renaming

Users of the plugin can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request,...

CVE-2021-45226

An issue was discovered in COINS Construction Cloud 11.12. Due to improper validation of user-controlled HTTP headers, attackers can cause it to send password-reset e-mails pointing to arbitrary websites...

Float Menu < 4.3.1 - Arbitrary Menu Deletion via CSRF

The plugin does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack https://example.com/wp-admin/admin.php?page=float-menu&info=delete&did=1...

CVE-2021-40694

CVE-2021-40694 affects Moodle-related components and is caused by insufficient escaping of the LaTeX preamble, enabling site administrators to read files accessible to the HTTP server system account. Reported impact per NVD: Confidentiality impact high; other impacts none; attack vector network; ...

Spotweb 跨站脚本漏洞

Spotweb is a Php-based Soptnet client from the Spotweb team that follows the Spotnet protocol. JavaScript code...

CVE-2021-44299

A reflected cross-site scripting XSS vulnerability in \lib\packages\themes\themes.php of Navigate CMS v2.9.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2021-44299

Naviga te CMS v2.9.4 is affected by CVE-2021-44299 due to a reflected XSS in the themes.php (under \lib\packages\themes\themes.php). The vulnerability arises from improper handling of crafted input, enabling an authenticated attacker to inject and execute arbitrary web scripts or HTML in the cont...

We Need to Encrypt DNS: Here’s Another Compelling Reason Why

Encrypting DNS servers is a necessary next step in web security to prevent sensitive materials from being breached, thus improving user privacy and security...

F5 BIG-IP 跨站脚本漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A cross-site scripting vulnerability exists in F5 BIG-IP, which can be exploited to run JavaScript in the context of the...

CVE-2021-46013

CVE-2021-46013 affects Sourcecodester Free school management software 1.0. The vulnerability is an unrestricted file upload in the exam_question uploads path that allows remote code execution via a uploaded PHP webshell (example: ) saved under /uploads/exam_question/. This leads to high-impact ou...

Pimcore 跨站脚本漏洞

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. pimcore has a cross-site scripting...

New Unpatched Apple Safari Browser Bug Allows Cross-Site User Tracking

A software bug introduced in Apple Safari 15's implementation of the IndexedDB API could be abused by a malicious website to track users' online activity in the web browser and worse, even reveal their identity. The vulnerability, dubbed IndexedDB Leaks, was disclosed by fraud protection software...

lymphactivist.org Cross Site Scripting vulnerability OBB-2336588

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

topo-guide-escalade.fr Cross Site Scripting vulnerability OBB-2335019

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

campanha.mydreams.com.br Cross Site Scripting vulnerability OBB-2334648

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-45422

Affected software: Reprise License Manager (RLM) 14.2. Vulnerability: reflected cross-site scripting (XSS) in the /goform/activate_process endpoint, via the count parameter in GET requests. Root cause: improper validation of user-controlled data leading to client-side code execution. Impact: coul...

UBUNTU-CVE-2022-23133

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation, the XSS payload will fire and the actor can...

Online Diagnostic Lab Management System 1.0 SQL Injection

Exploit Title: Online Diagnostic Lab Management System 1.0 - SQL Injection Unauthenticated Date: 11/01/2022 Exploit Author: Himash Vendor Homepage: https://www.sourcecodester.com/php/15129/online-diagnostic-lab-management-system-php-free-source-code.html Software Link:...