1385 matches found
ThinkPHP 路径遍历漏洞
ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology Company. A security vulnerability exists in ThinkPHP Framework versions prior to 6.0.14, which originates from allowing local files to be included via the lang...
CVE-2022-47945: Improper Limitation of a Pathname to a Restricted Directory
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...
CVE-2022-47945
ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...
GHSA-PWH3-3PCM-6VJH FeehiCMS vulnerable to Cross Site Scripting
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
FeehiCMS 跨站脚本漏洞
FeehiCMS is a Php based CMS builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.0.8. An attacker can exploit this vulnerability to execute arbitrary code via the lang attribute of the html tag...
PT-2022-8622 · Feehicms · Feehicms
Name of the Vulnerable Software and Affected Versions: FeehiCMS version 2.0.8 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the lang attribute of an HTML tag. This enables attackers to execute malicious scripts on the client-side, potentially...
CVE-2020-20589: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2020-36607: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2020-36607
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2022-4514: Improper Neutralization
A vulnerability, which was classified as problematic, was found in Opencaching Deutschland oc-server3. Affected is an unknown function of the file htdocs/lang/de/ocstyle/varset.inc.php. The manipulation of the argument varvalue leads to cross site scripting. It is possible to launch the attack...
CVE-2022-4514
A vulnerability, which was classified as problematic, was found in Opencaching Deutschland oc-server3. Affected is an unknown function of the file htdocs/lang/de/ocstyle/varset.inc.php. The manipulation of the argument varvalue leads to cross site scripting. It is possible to launch the attack...
CVE-2020-20589
The connected documents confirm CVE-2020-20589 affects FeehiCMS 2.0.8 with a Cross-Site Scripting (XSS) flaw in the lang attribute of HTML tags. The vulnerability enables remote attackers to deliver and execute malicious scripts in the victim’s browser (client-side impact). No official patch/vers...
CVE-2020-20589
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2020-20589
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code
Because of incorrect bounds on method Secp256k1::preallocatedgennew it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the context as a mutable reference and return...
GHSA-969W-Q74Q-9J8V Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code
Because of incorrect bounds on method Secp256k1::preallocatedgennew it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the context as a mutable reference and return...
RUSTSEC-2022-0070 Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code
Because of incorrect bounds on method Secp256k1::preallocatedgennew it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the context as a mutable reference and return...
CVE-2022-44256
TOTOLINK LR350 V9.3.5u.6369B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function...
TOTOLINK LR350 缓冲区错误漏洞
TOTOLINK LR350 is a 4G LTE router from China's Gion Electronics TOTOLINK that supports converting 4G signals to wired signals for home and office scenarios. A buffer overflow vulnerability exists in the TOTOLINK LR350. The vulnerability stems from a buffer overflow after validation via the...