15159 matches found
scratch-svg-renderer 跨站脚本漏洞
scratch-svg-renderer is a code library used by the Scratch team to convert SVG to DOM elements. scratch-Svg-Renderer suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in WEB applications, which can be exploited to execute client-si...
Django Denial of Service Vulnerability (CNVD-2022-03215)
Django is the Django Foundation's set of Python-based language open source Web application framework . The framework includes object-oriented mapper, view system, template system, etc. Django version 2.2 before 2.2.26, version 3.2 before 3.2.11, and version 4.0 before 4.0.1 has a denial-of-servic...
Sourcecodester Vehicle Service Management System 代码问题漏洞
Sourcecodester Vehicle Service Management System is an open source PHP project. A simple web application for automotive repair/service stores or businesses. Sourcecodester Vehicle Service Management System suffers from a file upload vulnerability that can be exploited by attackers to upload...
Django path traversal vulnerability (CNVD-2022-31938)
Django is the Django Foundation's set of Python-based language open source Web application framework . The framework includes an object-oriented mapper, view system, template system, etc. Django version 2.2 before 2.2.26, 3.2.11 before 3.2.2, and 4.0.1 before 4.0.0 contains a path traversal...
uDoctorAppointment 2.1.1 Cross Site Scripting
Document Title: =============== uDoctorAppointment v2.1.1 - Multiple XSS Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2288 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...
cWifi Hotspot Wireless CP Code Execution
Document Title: =============== cWifi Hotspot Wireless CP - Code Execution Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2310 Release Date: ============= 2021-12-15 Vulnerability Laboratory ID VL-ID: ====================================...
BeyondTrust Remote Support Cross-Site Request Forgery Vulnerability
BeyondTrust Remote Support is a remote desktop access, help desk and collaboration software for Windows, Mac, Linux, Ios iPad, iPhone, etc. BeyondTrust Remote Support is vulnerable to cross-site request forgery. The vulnerability stems from the lack of proper validation of client-side data in the...
Rocket LMS 1.1 Cross Site Scripting
Document Title: =============== Rocket LMS v1.1 - History Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2305 Release Date: ============= 2021-12-29 Vulnerability Laboratory ID VL-ID: ==================================== 23...
BeyondTrust Remote Support 跨站脚本漏洞
BeyondTrust Remote Support is a remote desktop access, help desk and collaboration software for Windows, Mac, Linux, Ios iPad, iPhone, etc. BeyondTrust Remote Support is vulnerable to cross-site request forgery. The vulnerability stems from the lack of proper validation of client-side data in the...
verkehrspsychologen-oberfranken.de Cross Site Scripting vulnerability OBB-2319973
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
webapp.dimensionsystems.com Cross Site Scripting vulnerability OBB-2318594
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
2021 in Review, Part 1: 5 Cybersecurity Topics that Made News
Its been another chaotic year in cybersecurity, as protecting web applications and stopping sensitive data breaches remain top-of-mind issues and continue to generate headline news. As 2021 comes to a close, cybersecurity and all the industries it serves is dealing with an unprecedented zero-day...
showdoc Cross-site Request Forgery Vulnerability (CNVD-2022-02730)
showdoc is an open source tool ideal for IT teams to share documents online. showdoc suffers from a cross-site request forgery vulnerability, which stems from a WEB application that does not sufficiently validate that the request is from a trusted user. An attacker could use this vulnerability to...
Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat
Description The application does not escape special characters, and the $msgPArent or $Result'additionalpostmessage' variables can lead to reflected XSS Proof of Concept https://demo.livehelperchat.com/chat/chatwidgetchat/444/123/theme/1/cstarted/123";;alert'xss';" Impact XSS can have huge...
SourceLeakHacker - A Multi Threads Web Application Source Leak Scanner
SourceLeakHacker is a muilt-threads web directories scanner. Installation pip install -r requirements.txt Usage dictionary scale --output OUTPUT output folder, default: result/YYYY-MM-DD hh:mm:ss --threads THREADS, -t THREADS threads numbers, default: 4 --timeout TIMEOUT HTTP request timeout...
showdoc 跨站请求伪造漏洞
showdoc is an open source tool ideal for IT teams to share documents online. showdoc suffers from a cross-site request forgery vulnerability, which stems from a WEB application that does not sufficiently validate that the request is from a trusted user. An attacker could use this vulnerability to...
Cross-site Scripting (XSS) - Reflected in livehelperchat/livehelperchat
Description The htmlspecialchars function does not escape special characters like single quote, and the $prefix parameter can lead to reflected XSS Proof of Concept https://demo.livehelperchat.com/siteadmin/user/avatarbuilder/1?=1640314779051&prefix=123%27;;%20alert%27xss%27;// Impact XSS can hav...
The vulnerability of the “Basic HTTP Authentication” method for the Ethernet web application of the WISE-4060 module allows a attacker to gain access to confidential information.
The vulnerability of the “Basic HTTP Authentication” method in the Ethernet web application of the WISE-4060 module involves the transmission of data in an open manner. Exploiting this vulnerability could allow a remote attacker to gain access to confidential information...
