EUVD-2021-2142

Malware in sbrugna...

EUVD-2020-4044

Malware in sbrugna...

EUVD-2022-6192

Malicious code in bioql PyPI...

Arbitrary Code Injection

Overview bolt/bolt is a sophisticated, lightweight & simple CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the function modify in the Users.php file. An attacker with valid credentials can execute arbitrary PHP code by injecting malicious input into the...

CVE-2025-34086

Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend...

Bolt CMS security vulnerabilities

Bolt CMS is a PHP-based open source content management system from Bolt CMS Open Source. A security vulnerability exists in Bolt CMS 3.7.0 and prior versions that originates from allowing an authenticated user to inject arbitrary PHP code into the displayname field, which could lead to remote cod...

CVE-2025-49012

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

CVE-2025-49012: Improper Authentication

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs...

CVE-2020-11702

An issue was discovered in ProVide formerly zFTPServer through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter...

CVE-2012-4397

Multiple cross-site scripting XSS vulnerabilities in ownCloud before 4.0.1 allow remote attackers to inject arbitrary web script or HTML via the 1 calendar displayname to part.choosecalendar.rowfields.php or 2 part.choosecalendar.rowfields.shared.php in apps/calendar/templates/; or 3 unspecified...

SUSE CVE-2011-2661

Multiple cross-site scripting XSS vulnerabilities in WebAccess in Novell GroupWise 8.0 before HP3 allow remote attackers to inject arbitrary web script or HTML via the 1 Directory.Item.name or 2 Directory.Item.displayName parameter...

OPENSUSE-SU-2023:0083-1 Security update for nextcloud

This update for nextcloud fixes the following issues: - Update to 23.0.12 See: https://nextcloud.com/changelog/latest23 - This also fix security issues: - CVE-2022-35931: Password Policy app could generate passwords that would be block boo1203190 - CVE-2022-39346: Missing length validation of use...

CVE-2022-39346 Missing length validation of user displayname in nextcloud server

Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a malicious users to overload the backing database and cause a denial of service. It is recommended that the Nextcloud Server is upgraded to...

CVE-2020-25491

6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting XSS via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page...

CVE-2020-25491

6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting XSS via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page...

Cross site scripting

6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting XSS via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page...

CVE-2020-25491: Improper Neutralization of Input During Web Page Generation

6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting XSS via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page...

6Kare Emakin Cross-Site Scripting Vulnerability

6Kare Emakin is a Business Process Management BPM system from 6Kare Turkey. A security vulnerability exists in 6Kare Emakin version 5.0.341.0, which was discovered to contain a cross-site scripting XSS vulnerability via the DisplayName field of /rpc/membership/setProfile...

PT-2022-8713

Name of the Vulnerable Software and Affected Versions 6Kare Emakin version 5.0.341.0 Description The issue is related to Cross Site Scripting XSS via the "/rpc/membership/setProfile" endpoint, specifically the DisplayName field, which is mishandled when rendering the Activity Stream page...

org.hudsonci.plugins:cvs (>=2.1.0, <=2.1.0_1), org.hudsonci.plugins:dependency-viewer (>=1.0, <=1.1) +29 more potentially affected by CVE-2015-8031 via org.jvnet.hudson.main:hudson-core (2.1.0)

org.jvnet.hudson.main:hudson-core MAVEN version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.jvnet.hudson.main:hudson-core and may be impacted: - org.hudsonci.plugins:cvs =2.1.0, =1.0, =1.0, =2.1.0, =2.1.01 -...