The vulnerability of the `check_forbidden` function in the rack/directory.rb module interface between web servers and Rack web applications allows a violator to access confidential data.

The vulnerability of the checkforbidden function in the rack/directory.rb module of the Rack framework, which is used between web servers and web applications, relates to an incorrect restriction on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain...

XWiki >= 11.4-rc-1, < 11.10.1, 12.x < 12.6.3, 12.7.x Privilege Escalation Vulnerability

XWiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Akamai Offers Free Tier for Client-Side Edge Security

In March of 2020, Akamai saw a dramatic 30% rise in internet traffic --- equivalent to an entire year of growth 1. Post-pandemic, Akamai believes there will be a return to normal internet traffic growth, but many things will never be the same. In general, we particularly expect to see greater...

CVE-2020-24983

CVE-2020-24983 affects Quadbase EspressReports ES 7 Update 9. A CSRF flaw allows an unauthenticated attacker to craft a malicious HTML file containing a POST to the DashboardBuilder that uses the victim’s admin session to rename a Dashboard, i.e., the attacker can trigger authenticated changes vi...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Activemq

CVE-2016-3088 Apache ActiveMQ Remote Code Execution Exploit...

CVE-2021-21363 Generator Web Application: Local Privilege Escalation Vulnerability via System Temp Directory

swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary...

Six Apart Movable Type Cross-Site Scripting Vulnerability (CNVD-2022-22653)

Six Apart Movable Type is an application of Six Apart, Inc. Six Apart Movable Type has a cross-site scripting vulnerability in several of its products, which stems from the lack of proper validation of client data in the WEB application and can be exploited to inject arbitrary scripts via...

IBM Engineering Requirements Management DOORS Next Cross-Site Scripting Vulnerability (CNVD-2021-17198)

IBM Engineering Requirements Management DOORS Next is a scalable solution from International Business Machines Corporation IBM. The solution helps you capture, track, analyze, and manage systems and advanced IT application development. A cross-site scripting vulnerability exists in IBM Engineerin...

Progress Software Telerik UI for ASP.NET AJAX 安全漏洞

Progress Software Telerik UI for ASP.NET AJAX is an HTML editor from Progress Software. A security vulnerability exists in Progress Software Telerik UI for ASP.NET AJAX 2021.1.224, which can be exploited by an attacker to gain unauthorized access to the server and execute code...

Six Apart Movable Type Cross-Site Scripting Vulnerability (CNVD-2022-22652)

Six Apart Movable Type is an application of Six Apart, Inc. Six Apart Movable Type has a cross-site scripting vulnerability in several of its products, which stems from the lack of proper validation of client data in the WEB application and can be exploited to inject arbitrary scripts via...

WEBIM 10.2.55 Cross Site Scripting

Exploit Title: XSS in WEBIM web application Date: 10.08.2021 Exploit Author: ASCII Vendor Homepage: HTTPS://WEBIM.RU Version: 10.2.55 Tested on: 10.2.55 Webim messanger XSS POC...

F5 BIG-IP 安全漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. F5 BIGIP AWAF/ASM Cache Overflow Vulnerability, malicious http response packets can lead to memory leakage when passing throug...

CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

Input validation

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

CVE-2020-28150

I-Net Software Clear Reports 20.10.136 web application accepts a user-controlled input that specifies a link to an external site, and uses the user supplied data in a Redirect...

CVE-2020-28150

CVE-2020-28150 affects I-Net Software Clear Reports 20.10.136 Web application. The vulnerability arises because a user-controlled input is used to specify a link to an external site and is subsequently used in a Redirect, enabling possible open-redirect behavior. Root cause: untrusted input used ...

I-Net Software Clear Reports 输入验证错误漏洞

I-net Software I-net software Clear Reports is a Java-based cross-platform reporting application from the German company I-net software I-net Software. The program supports the output of reports in PDF, HTML, PS and RTF formats. A security vulnerability exists in I-Net Software Clear Reports...

CVE-2020-27576

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting XSS. Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability...

CVE-2020-27576

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting XSS. Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability...

Cross site scripting

Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site scripting XSS. Users are able to create folders in the web application. The folder name is insufficiently validated resulting in a stored cross-site scripting vulnerability...