1366 matches found
PT-2022-15500
Name of the Vulnerable Software and Affected Versions SAP S/4HANA versions 100 through 106 Description The F0743 Create Single Payment application does not check uploaded or downloaded files, allowing an attacker with basic user rights to inject dangerous content or malicious code. This could...
CVE-2021-23824 Content Injection
This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting XSS vulnerability, assuming an attacker can influence the...
Content Injection
Overview Affected versions of this package are vulnerable to Content Injection. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting XSS vulnerability,...
Content Injection
Overview Affected versions of this package are vulnerable to Content Injection. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting XSS vulnerability,...
golang: net: lookup functions may return invalid host names
A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...
ArcGIS Server 代码注入漏洞
Esri Arcgis Server is a web-oriented, enterprise-class software platform that can be used to provide geolocation services from Esri, Inc. in the United States. A security vulnerability exists in ArcGIS Server that allows an attacker to inject html content into a page...
CVE-2021-40128 Cisco Webex Meetings Email Content Injection Vulnerability
A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameter...
CVE-2021-40128 Cisco Webex Meetings Email Content Injection Vulnerability
A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameter...
Ubuntu: Security Advisory (USN-5121-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
USN-5121-2 mailman vulnerabilities
USN-5009-1 fixed vulnerabilities in Mailman. This update provides the corresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs were fixed: It was discovered that Mailman allows arbitrary content injection. An attacker could use this to inject malicious content. CVE-2020-12108,...
USN-5121-2: Mailman vulnerabilities
USN-5009-1 fixed vulnerabilities in Mailman. This update provides the corresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs were fixed: It was discovered that Mailman allows arbitrary content injection. An attacker could use this to inject malicious content. CVE-2020-12108,...
Ubuntu 20.04 LTS : Mailman vulnerabilities (USN-5121-2)
The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5121-2 advisory. USN-5009-1 fixed vulnerabilities in Mailman. This update provides the corresponding updates for Ubuntu 20.04 LTS. In addition, the following CVEs were...
OESA-2021-1405 mailman security update
Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content...
Debian: Security Advisory (DSA-4991-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4991-1 : mailman - security update
The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-4991 advisory. - /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. CVE-2020-12108 - GNU Mailman before 2.1.33 allows arbitrary content injection...
[SECURITY] [DSA 4991-1] mailman security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4991-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 22, 2021 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4991-1] mailman security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4991-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 22, 2021 https://www.debian.org/security/faq -...
golang: net: lookup functions may return invalid host names
A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...
Email Content Injection
github.com/apache/trafficcontrol is vulnerable to email content injection. An authenticated attacker is able to send an email with a malicious body impersonating Traffic Ops server with the specifically-crafted email, subject to /deliveryservices/request Traffic Ops endpoint...
golang: net: lookup functions may return invalid host names
A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...