WordPress Tutor 1.5.3 Cross Site Scripting

Tile: Wordpress Plugin tutor.1.5.3 - Cross-Site Scripting - Author: mehran feizi - Category: webapps - Date: 2020.02.12 =================================================================== Vulnerable page: /Quiz.php =================================================================== Vulnerable...

vulhub

It is an open-source collection of pre-built vulnerable docker environments. The repository contains a variety of vulnerable environments based on Docker-Compose, including Flask, Apache, Nginx, and more. The environments are designed to be easy to use and require no pre-existing knowledge of...

Security Bulletin: Aspera Web Applications (Faspex, Console) are affected by Apache Vulnerabilities (CVE-2019-0196, CVE-2019-0197, CVE-2019-0215, CVE-2019-0217, CVE-2019-0220)

Summary Aspera Web Applications Faspex, Console have addressed the following Apache Vulnerabilities. Vulnerability Details CVEID: CVE-2019-0220 DESCRIPTION: A vulnerability was found in Apache HTTP Server 2.4.0 to 2.4.38. When the path component of a request URL contains multiple consecutive...

The vulnerability of the Application Service component of the software for working with Oracle Web Applications Desktop Integrator allows a perpetrator to gain access to modify, add, or delete data, or to gain unauthorized access to protected information.

The vulnerability of the Application Service component of the Oracle Web Applications Desktop Integrator software relates to deficiencies in access control. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to modify, add, or delete data using the HTTPS...

FlexNet Publisher 11.12.1 - Cross-Site Request Forgery (Add Local Admin) Vulnerability

Exploit for php platform in category web applications...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

Cross site scripting

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

CVE-2019-15607

A stored XSS vulnerability is present within node-red version: = 0.20.7 npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc...

The vulnerability of SAP NetWeaver Java Application Server web applications, related to insecure management of privileges, allows attackers to escalate their privileges.

The vulnerability of SAP NetWeaver Java Application Server web applications is related to insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

Fedora: Security Advisory for rubygem-rack (FEDORA-2020-57fc0d0156)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Protecting Websites from Magecart and Other In-Browser Threats

The Rise of Third-Party Scripts Modern web applications have become increasingly reliant on external code, services and vendors that execute JavaScript code in the browser... often referred to as third-party scripts. As a close-to-home example shown below, Akamai executes dozens of scripts to...

XXEinjector

This is an exploit module/toolkit targeting XXE XML eXternal Entity vulnerabilities. The primary CVE ID is not explicitly stated, but the tool is designed to automate exploitation of XXE vulnerabilities using direct and out-of-band methods. The target product/service is likely web applications,...

Oracle E-Business Suite Multiple Vulnerabilities (Jan 2020 CPU)

The version of Oracle E-Business installed on the remote host is missing the January 2020 Oracle Critical Patch Update CPU. It is, as noted in the January 2020 Critical Patch Update advisory, affected by flaws in the following components : - Oracle Human Resources - Oracle CRM Technical Foundatio...

[SECURITY] Fedora 31 Update: rubygem-rack-2.0.8-1.fc31

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a single...

CVE-2020-2591

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: Application Service. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2020-2591

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: Application Service. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2020-2591

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite component: Application Service. The supported version that is affected is 12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2020-2591

CVE-2020-2591 affects Oracle Web Applications Desktop Integrator (component: Application Service) in Oracle E-Business Suite, version 12.1.3. The CVSS 3.0 base score is 8.2 (HIGH) with network access required and user interaction, potentially leading to unauthorized read/write of data and broader...

Oracle E-Business Suite Unauthorized Access Vulnerability (CNVD-2020-04023)

Oracle E-Business Suite is in the original Application ERP based on the expansion, including ERP Enterprise Resource Planning, HR Human Resource Management, CRM Customer Relationship Management and so on a variety of management software collection, is a seamless integration of a management...