static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
Summary If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like <img src>.txt will allow JavaScript code execution in the context of the web server’s domain. Details SWS generally does not perform escaping of...
5.8CVSS
6.3AI Score
0.0004EPSS
The web interface for trixbox, an IP-PBX application based on Asterisk, was detected on the remote...
1.1AI Score
Mantis Bug Tracker (MantisBT), an open source issue tracker was detected on the remote host. Note: enabling thorough tests improves the likelihood that instances of MantisBT are detected at the cost of increasing the scan's duration and generated network...
7.4AI Score
4.3CVSS
7.4AI Score
0.001EPSS
namshi/jose insecure JSON Web Signatures (JWS)
namshi/jose allows the acceptance of unsecure JSON Web Signatures (JWS) by default. The vulnerability arises from the $allowUnsecure flag, which, when set to true during the loading of JWSes, permits tokens signed with 'none' algorithms to be processed. This behavior poses a significant security...
7AI Score
Malicious code in @westpac-components-web/hooks (npm)
-= Per source details. Do not edit below this line.=- Source: ghsa-malware (935f3ecec4f48a905f04e98df7c4b7010c6fdc9900763c6aa3fe749e8ffd9237) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
7AI Score
namshi/jose insecure JSON Web Signatures (JWS)
namshi/jose allows the acceptance of unsecure JSON Web Signatures (JWS) by default. The vulnerability arises from the $allowUnsecure flag, which, when set to true during the loading of JWSes, permits tokens signed with 'none' algorithms to be processed. This behavior poses a significant security...
7AI Score
Exploit for Improper Privilege Management in Openwebanalytics Open Web Analytics
CVE-2022-24637 Unauthenticated RCE in Open Web Analytics...
9.8CVSS
9.4AI Score
0.894EPSS
Symantec Web Gateway Login Utility
This module will attempt to authenticate to a Symantec Web...
7.2AI Score
IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: .....
4.8CVSS
4.8AI Score
0.0004EPSS
(RHSA-2024:3560) Important: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.16, and includes bug...
5.9AI Score
0.002EPSS
(RHSA-2024:3559) Important: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.16, and includes bug...
5.9AI Score
0.002EPSS
Joomla! Plugin Core Design Scriptegrator - Local File Inclusion
A directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences in the files[]...
6.8AI Score
0.016EPSS
Checkbox Survey, a web application for creating surveys was detected on the remote host. Note: If credentials for HTTP basic authentication / digest are supplied, then an attempt to retrieve the version information from the API will be...
2.2AI Score
Junos J-Web, a web application for sending and receiving SMS, was detected on the remote...
7.5AI Score
0.9AI Score
(RHSA-2024:3561) Important: Red Hat JBoss Enterprise Application Platform 7.4.17 Security update
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.17 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.16, and includes bug...
5.9AI Score
0.002EPSS
Mattermost crashes web clients via a malformed custom status in...
4.3CVSS
4.6AI Score
0.0004EPSS
The web UI for Grafana Labs was detected on the remote host. Note : The application can be reconfigured to reveal the version by setting hide_version = false under [auth.anonymous] in the grafana.ini...
7AI Score
Apple AirPlay, formerly AirTunes, was detected on the remote host. It is possible to obtain information about the remote device from this service's...
1.1AI Score
Graylog2 Web Interface Detection
The web interface for Graylog2, a log collection and analysis platform, was detected on the remote host. It is possible to extract version information if login credentials are provided on...
1.8AI Score
The remote web server is hosting Open Web Analytics, a web application framework for tracking and analyzing website and web application...
1.1AI Score
7.8CVSS
8.1AI Score
0.006EPSS
Chef Web UI Brute Force Utility
This module attempts to login to Chef Web UI server instance using username and password combinations indicated by the USER_FILE, PASS_FILE, and USERPASS_FILE options. It will also test for the default login...
7.5AI Score
6.5CVSS
6.8AI Score
0.001EPSS
DirectAdmin Web Control Panel Login Utility
This module will attempt to authenticate to a DirectAdmin Web Control...
7.2AI Score
BAVision IP Camera Web Server Login
This module will attempt to authenticate to an IP camera created by BAVision via the web service. By default, the vendor ships a default credential admin:123456 to its cameras, and the web server does not enforce lockouts in case of a bruteforce...
7.2AI Score
A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection....
9.8CVSS
9.8AI Score
0.003EPSS
A vulnerability classified as problematic has been found in web-cyradm. This affects an unknown part of the file search.php. The manipulation of the argument searchstring leads to sql injection. It is recommended to apply a patch to fix this issue. The identifier VDB-217449 was assigned to this...
7.5CVSS
7.9AI Score
0.001EPSS
A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the.....
5.4CVSS
5.2AI Score
0.001EPSS
The remote server is running a Citrix Web Interface server that is vulnerable to cross site...
6.2AI Score
0.009EPSS
RHEL 6 : icedtea-web (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. icedtea-web: unsigned code injection in a signed JAR file (CVE-2019-10181) icedtea-web: directory...
8.3AI Score
0.027EPSS
A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has...
5.4CVSS
5.2AI Score
0.001EPSS
A vulnerability was found in ytti Oxidized Web. It has been classified as problematic. Affected is an unknown function of the file lib/oxidized/web/views/conf_search.haml. The manipulation of the argument to_research leads to cross site scripting. It is possible to launch the attack remotely. The.....
5.4CVSS
5.2AI Score
0.001EPSS
It is possible to browse the information of the OWA server by accessing as an anonymous...
6.2AI Score
0.015EPSS
Jasmin Ransomware Web Server Unauthenticated Directory Traversal
The Jasmin Ransomware web server contains an unauthenticated directory traversal vulnerability within the download functionality. As of April 15, 2024 this was still unpatched, so all versions are vulnerable. The last patch was in 2021, so it will likely not ever be...
7.5AI Score
0.005EPSS
Jasmin Ransomware Web Server Unauthenticated SQL Injection
The Jasmin Ransomware web server contains an unauthenticated SQL injection vulnerability within the login functionality. As of April 15, 2024 this was still unpatched, so all versions are vulnerable. The last patch was in 2021, so it will likely not ever be patched. Retrieving the victim's data...
8.3AI Score
0.005EPSS
7.8CVSS
7.7AI Score
0.01EPSS
A vulnerability, which was classified as critical, has been found in web-cyradm. Affected by this issue is some unknown functionality of the file auth.inc.php. The manipulation of the argument login/login_password/LANG leads to sql injection. The attack may be launched remotely. The name of the...
9.8CVSS
9.7AI Score
0.002EPSS
The addon.stdin service in addon-ssh (aka Home Assistant Community Add-on: SSH & Web Terminal) before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against.....
8.8CVSS
8.6AI Score
0.002EPSS
Exploit for Command Injection in Sophos Web Appliance
CVE-2023-1671 Vulnerability Scanner ![GitHub last...
9.8CVSS
9.9AI Score
0.965EPSS
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special...
8.8CVSS
7.8AI Score
0.135EPSS
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special...
5.5CVSS
5.5AI Score
0.014EPSS
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Fuzzy SWMP. It has been rated as problematic. This issue affects some unknown processing of the file swmp.php of the component GET Parameter Handler. The manipulation of the argument theme leads to cross site scripting. The attack may be....
6.1CVSS
6AI Score
0.001EPSS
The web user interface for Apache Kylin was detected on the remote...
7.5AI Score
Tableau Server Web UI Detection
The web user interface for Tableau Server was detected on the remote...
0.8AI Score
Netwrix Auditor Web API Detection
Netwrix Auditor, an auditing and optimization solution used for compliance operations was detected on the remote host via the Netwrix Integrator API. Note: HTTP basic authentication credentials are required by the API for reliable detection. Alternatively, when the paranoid setting is enabled the.....
1.4AI Score
ThoughtWorks GoCD Web interface detection
ThoughtWorks GoCD, a CI / CD server, was detected based on the web...
1AI Score
Apache Flink web user interface detected on remote host. Apache Flink is an open-source, unified stream-processing and batch-processing framework developed by the Apache Software...
1.6AI Score
Zimbra Collaboration Server Web Detection
The web interface for Zimbra Collaboration Server, an open source messaging and collaboration solution, was detected on the remote host. Note the plugin attempts to retrieve the version information without credentials. However, if HTTP Basic credentials are supplied then an attempt to retrieve the....
1.8AI Score