GHSA-6495-8JVH-F28X File restriction bypass in socket.io-file

All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the name value to upload any file types. No fix is currently...

File restriction bypass in socket.io-file

Overview All versions of socket.io-fileare vulnerable to a file restriction bypass. The validation for valid file types only happens on the client-side, which allows an attacker to intercept the Websocket request post-validation and alter the name value to upload any file types. Recommendation No...

Design/Logic Flaw

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.002 to V3.15.704 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content such as JavaScript or other client-side scripts as the...

CVE-2019-19393

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.002 to V3.15.704 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content such as JavaScript or other client-side scripts as the...

GitLab Cross-Site Scripting Vulnerability (CNVD-2020-57834)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A cross-site scripting vulnerability exists in GitLab...

Pagure Input Validation Error Vulnerability

Pagure is a Git repository written in Python to provide Web services. A cross-site scripting vulnerability exists in Pagure versions prior to 5.6, which stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...

Drupal core cross-site scripting vulnerability (CNVD-2020-65151)

Drupal core is a free, open source content management system developed in PHP by the Drupal community. A cross-site scripting vulnerability exists in Drupal core. The vulnerability stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this...

SolarWinds Orion Platform Cross-Site Scripting Vulnerability (CNVD-2020-52937)

SolarWinds Orion Platform is a network fault and network performance management platform from SolarWinds, Inc. The platform provides real-time monitoring and analysis of network devices and supports a customizable web interface, multiple user opinions, and a mapped view of the entire network. A...

SAP NetWeaver AS ABAP Business Server Cross-Site Scripting Vulnerability (CNVD-2020-52936)

SAP NetWeaver AS ABAP Business Server is an application server for ABAP Advanced Business Application Programming from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver AS ABAP Business Server Pages. The vulnerability stems from a lack of proper validation of client-side...

IBM OpenPages Cross-Site Scripting Vulnerability

IBM OpenPages GRC Platform is a suite of platforms for managing enterprise risk and compliance from IBM in the United States. The platform provides a set of core services and functional components that cover the risk and compliance domain including operational risk, policy and compliance, financi...

CloudBees Jenkins Description Column Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CloudBees Jenkins Android Lint Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CloudBees Jenkins Validating String Parameter Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CloudBees Jenkins Pipeline Maven Integration Cross Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

CloudBees Jenkins chosen-views-tabbar Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . A cross-site scripting...

SourceCodester Tailor Management System XSS Injection Vulnerability

Tailor Management System is a customized management system. An XSS vulnerability exists in the index.php product in SourceCodester Tailor Management System, which stems from a lack of proper validation of client-side data in the web application and can be exploited by an attacker to execute...

Rukovoditel Cross-Site Scripting Vulnerability (CNVD-2020-52204)

Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management , customer relationship management and other functions . A cross-site scripting vulnerability exists in Rukovoditel Project Managemen versions prior to 2.6, whi...

KaiOS Contacts Cross-Site Scripting Vulnerability (CNVD-2020-52884)

KaiOS is a Linux-based mobile operating system. A cross-site scripting vulnerability exists in KaiOS versions 2.5 and 2.5.1. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side cod...

KaiOS Recorder Cross-Site Scripting Vulnerability (CNVD-2020-52886)

KaiOS is a Linux-based mobile operating system. A cross-site scripting vulnerability exists in KaiOS version 2.5. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

KaiOS Contacts Cross-Site Scripting Vulnerability

KaiOS is a Linux-based mobile operating system. A cross-site scripting vulnerability vulnerability exists in KaiOS versions 2.5 and 2.5.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute...