WebSOC Knows of Weak Password Vulnerability in Website Stereo Monitoring System

WebSOC is a web security monitoring product of Knowledge Creation. The WebSOC Web site monitoring system has a weak password vulnerability, which can be exploited by attackers to obtain sensitive information...

CVE-2021-28420

A cross-site scripting XSS issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "fromtime" parameter...

CVE-2021-28379

CVE-2021-28379 affects Vesta Control Panel (VestaCP) and myVesta up to versions 0.9.8-27 / 0.9.8-26-39, where web/upload/UploadHandler.php does not enforce origin checks, allowing cross-origin file uploads. The vulnerability is described as a CSRF-style/file upload issue that can enable uploading...

openMAINT 2.1-3.3-b Cross Site Scripting

Exploit Title: openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting Date: 13/03/2021 Exploit Author: Hosein Vita Vendor Homepage: https://www.openmaint.org/ Software Link: https://sourceforge.net/projects/openmaint/files/2.1/Core%20updates/openmaint-2.1-3.3.1/ Version: 2.1-3...

CVE-2021-28141

CVE-2021-28141 affects Progress Telerik UI for ASP.NET AJAX 2021.1.224. An issue allows unauthorized access to MicrosoftAjax.js via Telerik.Web.UI.WebResource.axd, potentially enabling an attacker to gain server access and execute code by appending a command after the URI using the TSM_HiddenFiel...

F5 BIG-IP 跨站脚本漏洞

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. F5 BIG-IP suffers from a cross-site scripting vulnerability that can be exploited by an attacker to trigger cross-site scripti...

UBUNTU-CVE-2021-3377

The npm package ansiup converts ANSI escape codes into HTML. In ansiup v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting XSS vulnerability. This issue is fixed in v5.0.0...

CVE-2021-20351

CVE-2021-20351 describes a cross-site scripting vulnerability in IBM Engineering products, allowing attackers to inject arbitrary JavaScript via the Web UI and potentially disclose credentials within a trusted session. The issue affects multiple IBM Engineering products in the Engineering Lifecyc...

CVE-2020-13558

The CVE-2020-13558 entry concerns WebKitGTK/WebKit2GTK 2.30.1 where AudioSourceProviderGStreamer contains a use-after-free that can be triggered by processing crafted web content, potentially allowing arbitrary code execution. Connected advisories confirm affected products and fixes: Debian lists...

CVE-2021-23347

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...

OWASP ASST (Automated Software Security Toolkit) - A Novel Open Source Web Security Scanner

OWASP ASST Automated Software Security Toolkit | A Novel Open Source Web Security Scanner. Note: AWSS is the older name of ASST Introduction Web applications have become an integral part of everyday life, but many of these applications are deployed with critical vulnerabilities that can be fatall...

IBM Jazz Foundation 跨站脚本漏洞

IBM Jazz Foundation is a next-generation collaboration platform for software delivery technology from International Business Machines Corporation IBM. IBM Jazz Foundation suffers from a cross-site scripting vulnerability that can be exploited by an attacker to embed arbitrary JavaScript code in t...

Vehicle Parking Management System 1.0 - (catename) Persistent Cross-Site Scripting Vulnerability

Exploit Title: Vehicle Parking Management System 1.0 - 'catename' Persistent Cross-Site Scripting XSS Exploit Author: Tushar Vaidya Vendor Homepage: https://www.sourcecodester.com/php/14415/vehicle-parking-management-system-project-phpmysql-full-source-code.html Software Link:...

Online Trackers Increasingly Switching to Invasive CNAME Cloaking Technique

With browser makers steadily clamping down on third-party tracking, advertising technology companies are increasingly embracing a DNS technique to evade such defenses, thereby posing a threat to web security and privacy. Called CNAME Cloaking, the practice of blurring the distinction between...

Online Trackers Increasingly Switching to Invasive CNAME Cloaking Technique

With browser makers steadily clamping down on third-party tracking, advertising technology companies are increasingly embracing a DNS technique to evade such defenses, thereby posing a threat to web security and privacy. Called CNAME Cloaking, the practice of blurring the distinction between...

SQL injection vulnerability in pr***.asp page of website building system of Ningbo Hi-Tech Zone Aokai Network Technology Co.

Ningbo Hi-Tech Zone Aokai Network Technology Co., Ltd, provides appropriate business and Internet brand promotion services. Ningbo High-tech Zone Aokai Network Technology Co., Ltd. building system pr.asp page SQL injection vulnerability, attackers can use the vulnerability to obtain sensitive...

CVE-2021-20066

JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled...

nodejs: HTTP request smuggling via two copies of a header field in an http request

A flaw was found in nodejs. Affected versions of Node.js allow two copies of a header field in an HTTP request. The first header field is recognized while the second is ignored leading to HTTP request smuggling. The highest threat from this vulnerability is to data confidentiality and integrity...

BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting (XSS)

Exploit Title: BlackCat CMS 1.3.6 - 'Display name' Cross Site Scripting XSS Date: 16-02-2021 Exploit Author: Kamaljeet Kumar - TATA Advanced Systems Limited Vendor Homepage: https://blackcat-cms.org/ Software Link: https://blackcat-cms.org/page/download.php Version: BlackCat CMS - 1.3.6 Tested on...

The vulnerability of the components of the Cisco Email Security Appliance, a system for email security management, and the Cisco Content Security Management Appliance, a system for content security management, as well as the Cisco Web Security Appliance, an internet gateway, allows attackers to gain unauthorized access to protected information.

The vulnerability of the components of the Cisco Email Security Appliance, the Cisco Content Security Management Appliance, and the Cisco Web Security Appliance involves a lack of authentication token requirements. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...