Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
89 results · page 2 of 2
Apr 25, 2022ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library.CVE-2022-23457 · Other software · OWASP ESAPI · reported by GitHubHigh 7.5
ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
- Product
- org.owasp.esapi:esapi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input.CVE-2022-29577 · Other software · Antisamy Project · reported by MITREMedium 6.1
OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
- Product
- Antisamy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input.CVE-2022-28367 · Other software · Antisamy Project · reported by MITREMedium 6.1
OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
- Product
- Antisamy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 24, 2022OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.CVE-2022-27820 · Other software · Owasp · reported by MITREMedium 4
OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.
- Product
- ZED Attack Proxy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comgithub.com
Dec 7, 2021ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects.CVE-2021-42717 · Other software · Owasp · reported by MITREHigh 7.5
ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON objects. Crafted JSON objects with nesting tens-of-thousands deep could result in the web server being unable to service legitimate requests. Even a moderately large (e.g., 300KB) HTTP request can occupy one of the limited NGINX worker processes for minutes and consume almost all of the available CPU on the machine. Modsecurity 2 is similarly vulnerable: the affected versions include 2.8.0 through 2.9.4.
- Product
- Modsecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.debian.orgdebian.org
Nov 12, 2021Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.CVE-2021-43577 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 7.1
Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
- Product
- Jenkins OWASP Dependency-Check Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 5, 2021OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.CVE-2021-35368 · Other software · Owasp · reported by MITRECritical 9.8
OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoreruleset.orglists.debian.org
Oct 18, 2021The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.CVE-2021-42575 · Other software · Owasp · reported by MITRECritical 9.8
The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
- Product
- Java Html Sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comoracle.com
Aug 19, 2021In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.CVE-2021-28490 · Other software · Owasp · reported by MITREHigh 8.8
In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.
- Product
- Csrfguard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 19, 2021OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected).CVE-2021-35043 · Other software · Antisamy Project · reported by MITREMedium 6.1
OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with : as the replacement for the : character.
- Product
- Antisamy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 22, 2021It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.CVE-2010-3300 · Other software · Owasp · reported by Red HatMedium 5.9
It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.
- Product
- Enterprise Security API For Java
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgusenix.org
May 6, 2021ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =CVE-2019-25043 · Other software · Owasp · reported by MITREMedium 5.3
ModSecurity 3.x before 3.0.4 mishandles key-value pair parsing, as demonstrated by a "string index out of range" error and worker-process crash for a "Cookie: =abc" header.
- Product
- Modsecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 30, 2021A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specifieCVE-2021-21633 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
A cross-site request forgery (CSRF) vulnerability in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
- Product
- Jenkins OWASP Dependency-Track Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Mar 30, 2021A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-spCVE-2021-21632 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.5
A missing permission check in Jenkins OWASP Dependency-Track Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL, capturing credentials stored in Jenkins.
- Product
- Jenkins OWASP Dependency-Track Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jan 13, 2021OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input.CVE-2021-23900 · Other software · Owasp · reported by MITREHigh 7.5
OWASP json-sanitizer before 1.2.2 can output invalid JSON or throw an undeclared exception for crafted input. This may lead to denial of service if the application is not prepared to handle these situations.
- Product
- Json-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2021OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input.CVE-2021-23899 · Other software · Owasp · reported by MITRECritical 9.8
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
- Product
- Json-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2020Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request.CVE-2020-15598 · Other software · Owasp · reported by MITREHigh 7.5
Trustwave ModSecurity 3.x through 3.0.4 allows denial of service via a special request. NOTE: The discoverer reports "Trustwave has signaled they are disputing our claims." The CVE suggests that there is a security issue with how ModSecurity handles regular expressions that can result in a Denial of Service condition. The vendor does not consider this as a security issue because1) there is no default configuration issue here. An attacker would need to know that a rule using a potentially problematic regular expression was in place, 2) the attacker would need to know the basic nature of the regular expression itself to exploit any resource issues. It's well known that regular expression usage can be taxing on system resources regardless of the use case. It is up to the administrator to decide on when it is appropriate to trade resources for potential security benefit
- Product
- Modsecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jun 9, 2020OWASP json-sanitizer before 1.2.1 allows XSS.CVE-2020-13973 · Other software · Owasp · reported by MITREMedium 6.1
OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
- Product
- Json-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2020Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming CVE-2019-19886 · Other software · Owasp · reported by MITREHigh 7.5
Trustwave ModSecurity 3.0.0 through 3.0.3 allows an attacker to send crafted requests that may, when sent quickly in large volumes, lead to the server becoming slow or unresponsive (Denial of Service) because of a flaw in Transaction::addRequestHeader in transaction.cc.
- Product
- Modsecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.fedoraproject.orglists.fedoraproject.org
Jul 9, 2019An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2.CVE-2019-13464 · Other software · Modsecurity · reported by MITREHigh 7.5
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) 3.0.2. Use of X.Filename instead of X_Filename can bypass some PHP Script Uploads rules, because PHP automatically transforms dots into underscores in certain contexts where dots are invalid.
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 13, 2019The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstratCVE-2019-11886 · WordPress plugins & themes · reported by MITREHigh 8.8
The WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) plugin before 7.2.1 for WordPress allows yp_option_update CSRF, as demonstrated by use of yp_remote_get to obtain admin access.
- Product
- WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer)
- Fixed in
- 7.2.1
- What to do
- Update WaspThemes Visual CSS Style Editor (aka yellow-pencil-visual-theme-customizer) to 7.2.1 or newer.
Full record and what to do →NVD recordwordpress.orgwpvulndb.com
Apr 20, 2019An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0.CVE-2019-11391 · Other software · Modsecurity · reported by MITREMedium 5.3
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with $a# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2019An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0.CVE-2019-11390 · Other software · Modsecurity · reported by MITREMedium 5.3
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with set_error_handler# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2019An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0.CVE-2019-11389 · Other software · Modsecurity · reported by MITREMedium 5.3
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with next# at the beginning and nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2019An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0.CVE-2019-11388 · Other software · Modsecurity · reported by MITREMedium 5.3
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators. NOTE: the software maintainer disputes that this is a vulnerability because the issue cannot be exploited via ModSecurity
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2019An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0.CVE-2019-11387 · Other software · Modsecurity · reported by MITREMedium 5.3
An issue was discovered in OWASP ModSecurity Core Rule Set (CRS) through 3.1.0. /rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf allows remote attackers to cause a denial of service (ReDOS) by entering a specially crafted string with nested repetition operators.
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcoreruleset.orggithub.com
Apr 4, 2019Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with aCVE-2019-1003060 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
- Product
- Jenkins Official OWASP ZAP Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Sep 2, 2018A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special funCVE-2018-16384 · Other software · Owasp · reported by MITREHigh 7.5
A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity Core Rule Set (owasp-modsecurity-crs) through v3.1.0-rc3 via {`a`b} where a is a special function name (such as "if") and b is the SQL statement to be executed.
- Product
- Owasp Modsecurity Core Rule SET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Jul 3, 2018ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element.CVE-2018-13065 · Other software · Owasp · reported by MITREMedium 6.1
ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured
- Product
- Modsecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackings8n.blogspot.com
Jun 7, 2018OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.CVE-2018-12036 · Other software · Owasp · reported by MITREHigh 7.8
OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
- Product
- Dependency-check
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2017The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability: CVE-2017-1000109 · Websites & servers · Jenkins · reported by MITREMedium 6.1
The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view.
- Product
- Owasp Dependency-check
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comjenkins.io
Sep 25, 2017OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.CVE-2017-14735 · Other software · Antisamy Project · reported by MITREMedium 6.1
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
- Product
- Antisamy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordoracle.comsecurityfocus.com
Dec 24, 2016In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protectionCVE-2016-10006 · Other software · Antisamy Project · reported by MITREMedium 6.1
In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
- Product
- Antisamy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comsecuritytracker.com
Oct 20, 2014The WASPS Official Programmes (aka com.triactivemedia.wasps) application @7F080130 for Android does not verify X.509 certificates from SSL servers, which allowsCVE-2014-7613 · Other software · Pocketmags · reported by cret@cert.orgMedium 5.4
The WASPS Official Programmes (aka com.triactivemedia.wasps) application @7F080130 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
- Product
- Wasps Official Programmes
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 30, 2013The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does noCVE-2013-5960 · Other software · Owasp · reported by MITREMedium 5.8
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
- Product
- Enterprise Security API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comlists.owasp.org
Sep 30, 2013The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not CVE-2013-5679 · Other software · Owasp · reported by MITRELow 2.6
The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
- Product
- Enterprise Security API
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comlists.owasp.org
Nov 17, 2011OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitiCVE-2011-4457 · Other software · Owasp-java-html-sanitizer Project · reported by MITRELow 2.6
OWASP HTML Sanitizer (aka owasp-java-html-sanitizer) before 88, when JavaScript is disabled, allows user-assisted remote attackers to obtain potentially sensitive information via a crafted FORM element within a NOSCRIPT element.
- Product
- Owasp-java-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode.google.comowasp-java-html-sanitizer.googlecode.com
Aug 17, 2007OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests.CVE-2007-4385 · Other software · Owasp · reported by MITREMedium 6.8
OWASP Stinger before 2.5 allows remote attackers to bypass input validation routines by using multipart encoded requests instead of form-urlencoded requests. NOTE: this might be used to expose vulnerabilities in applications that would otherwise be protected by the validation routines.
- Product
- Stinger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2006Cross-site scripting (XSS) vulnerability in WebScarab before 20060718-1904, when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote aCVE-2006-3841 · Other software · Owasp · reported by MITRELow 2.6
Cross-site scripting (XSS) vulnerability in WebScarab before 20060718-1904, when used with Microsoft Internet Explorer 6 SP2 or Konqueror 3.5.3, allows remote attackers to inject arbitrary web script or HTML via the URL, which is not sanitized before being returned in an error message when WebScarab is not able to access the URL.
- Product
- Webscarab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.ukmoritz-naumann.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.