Apache NiFi Login Scanner

This module attempts to take login details for Apache NiFi websites and identify if they are valid or not. Tested against NiFi major releases 1.14.0 - 1.21.0, and 1.13.0 Also works against NiFi use auxiliary/scanner/http/apachenifilogin msf auxiliaryapachenifilogin show actions ...actions... msf...

CVE-2023-34220

In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible...

Deliver Fast, Reliable, and Secure Web Experiences with HTTP/3

...

web.intake.education Cross Site Scripting vulnerability OBB-3368702

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-33736

CVE-2023-33736 is a stored XSS vulnerability in Dcat-Admin v2.1.3-beta, exploitable via a crafted payload injected into a URL parameter. The impact is arbitrary web script/HTML execution as described; no explicit fix/version in the provided documents. Connected sources reference advisories and ex...

Apple Zeed ALL YOUR STYLE CMS 2.0 SQL Injection

======================================================================================== | Title : Apple Zeed ALL YOUR STYLE CMS 2.0 SQL injection Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 109.064-bit | | Vendor :...

WordPress Plugin CRM Perks Forms 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

scaccidentlawyer.com Cross Site Scripting vulnerability OBB-3368396

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

culture41.fr Cross Site Scripting vulnerability OBB-3367198

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

woldhuisfarms.com Cross Site Scripting vulnerability OBB-3366192

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

tristandc.com Cross Site Scripting vulnerability OBB-3366143

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

What is a web shell?

Editors note: The Need to Know is a new series from Talos, which focuses on cybersecurity terms, threats, tools and tactics that are discussed in our broader threat research. Think of this as a living encyclopedia of security terms and trends. Cisco Talos Incident Response recently released our...

uniquemagazines.co.uk Cross Site Scripting vulnerability OBB-3363677

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

wl4www229.webland.ch Cross Site Scripting vulnerability OBB-3363421

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

golang: html/template: improper handling of empty HTML attributes

A flaw was found in golang. Templates containing actions in unquoted HTML attributes, for example, "attr=." executed with empty input, could result in output that has unexpected results when parsed due to HTML normalization rules. This issue may allow the injection of arbitrary attributes into ta...

CVE-2023-33750

CVE-2023-33750 is a stored XSS vulnerability affecting mipjz v5.0.5. The flaw allows an attacker to inject arbitrary web scripts/HTML via the Description parameter in /index.php?s=/article/ApiAdminArticle/itemAdd, enabling client-side exploitation when a user views the infected page. The CVSS/met...

CVE-2023-33751

CVE-2023-33751 affects mipjz v5.0.5. The vulnerability is a stored XSS in the name parameter at /app/tag/controller/ApiAdminTagCategory.php, allowing arbitrary web scripts/HTML execution. Exploit details are not provided in the connected documents; exploitation status is listed as null. No remedi...

toui allows user-specific variables to be shared between users

Impact Websites that use Website.uservars property in versions. Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1 Workarounds Do not use Website.uservars in websites when using versions v2.0.1 to v2.4.0. Also, do not use Website.signinuser in version v2.4.0 only. Explanation...

SitemagicCMS 4.4.3 Shell Upload

Exploit Title: SitemagicCMS 4.4.3 Remote Code Execution RCE Application: SitemagicCMS Version: 4.4.3 Bugs: RCE Technology: PHP Vendor URL: https://sitemagic.org/Download.html Software Link: https://github.com/Jemt/SitemagicCMS Date of found: 14-05-2023 Author: Mirabbas Ağalarov Tested on: Linux 2...