9942 matches found
Cross-Site Scripting in mrk.js
Versions of mrk.js before 2.0.1 are vulnerable to cross-site scripting XSS when markdown is converted to HTML. Recommendation Update to version 2.0.1 or later and use mark.sanitizeURL for any src and href attributes when extending the markdown...
PT-2020-21395
Name of the Vulnerable Software and Affected Versions react-marked-markdown versions affected versions not specified Description The issue concerns cross-site scripting XSS via href attributes in react-marked-markdown. This can be exploited when a user is provided to react-marked-markdown. There ...
IBM Security Guardium Data Encryption (GDE) Information Disclosure Vulnerability (CNVD-2020-49938)
IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. An information disclosure vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which stems...
PT-2020-5513 · Apache +1 · Apache Struts +1
Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.5.20 Description: The issue is related to insufficient control of modification of dynamically determined characteristics of an object in the Apache Struts platform. This can be exploited by a remote...
Exploit for Prototype Pollution in Apache Struts
CVE-2019-0230 CVE-2019-0230 Exploit This is CVE-2019-0...
Prototype Pollution
flat is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes such as proto, constructor and prototype...
CSS Injection
chartkick is vulnerable to CSS injection. A remote attacker is able to inject arbitrary CSS without attributes...
CVE-2020-15109
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...
Design/Logic Flaw
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...
CVE-2020-15109
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...
CVE-2020-15109 Ability to change order address without triggering address validations in solidus
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...
CVE-2020-15109
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...
GHSA-3MVG-RRRW-M7PH Ability to change order address without triggering address validations in solidus
Impact This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zo...
PT-2020-14191
Name of the Vulnerable Software and Affected Versions Solidus versions prior to 2.8.6 Solidus versions prior to 2.9.6 Solidus versions prior to 2.10.2 Description This issue allows a malicious customer to change the order address without triggering address validations, potentially altering shipme...
CVE-2020-15109: Improper Input Validation
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the...
Extract and Use Custom Attributes from Active Directory for NetScaler Appliance
Although Active Directory AD username and realm/domain attributes are often sufficient for identifying a user, at times you need even more details of the user. For example, "UserPrincipalName" that contains the user’s domain might represent a forest level realm and not the organization to which t...
IBM Publishing Engine Information Disclosure Vulnerability
IBM Publishing Engine is a tool for generating documents from data stored in other software tools. An information disclosure vulnerability exists in IBM Publishing Engine 6.0.6, 6.0.6.1, and 7.0, which stems from the product not setting security attributes on authorization tokens or session...
CVE-2020-15721
RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...
