PT-2023-26780 · Unknown · Webboss.Io Cms

Name of the Vulnerable Software and Affected Versions: WebBoss.io CMS version 3.7.0.1 Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability. This occurs due to a lack of input validation and output encoding, allowing malicious scripts to be stored and executed...

The vulnerability of the SAP Solution Manager (Diagnostics agent) platform, related to the lack of mechanisms for encoding or blocking output data, allows for the execution of XSS attacks.

The vulnerability of the SAP Solution Manager Diagnostics agent platform is related to the lack of mechanisms for encoding or blocking output data. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

The vulnerability of Cisco AsyncOS operating system’s scanning mechanism for Cisco Secure Web Appliances allows attackers to circumvent traffic blocking rules.

The vulnerability of the Cisco AsyncOS operating system’s scanning mechanism for the Cisco Secure Web Appliance is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to circumvent traffic blocking rules when encoding types such as deflate, lzma,...

WebBoss.io Cross-Site Scripting Vulnerability

WebBoss.io is a website building platform for professional designers and developers from WebBoss.io, Inc. A security vulnerability exists in WebBoss.io CMS version v3.7.0.1 that stems from a lack of input validation and output coding...

CVE-2023-39096

WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting XSS vulnerability due to lack of input validation and output encoding...

Cisco Secure Web Appliance Content Encoding Filter Bypass Vulnerability

A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass a configured rule, allowing traffic onto a network that should have been blocked. This vulnerability is due to improper detection of malicious...

CVE-2023-26443

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single...

Sql injection

Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. With existing sanitization in place, this can be abused to trigger benign SQL Exceptions but could potentially be escalated to a malicious SQL injection vulnerability. We now properly encode single...

PT-2023-4106 · Cisco · Cisco Secure Web Appliance +1

Name of the Vulnerable Software and Affected Versions: Cisco Secure Web Appliance versions affected versions not specified Description: The issue is related to a flaw in the scanning mechanism of Cisco AsyncOS for Cisco Secure Web Appliance, specifically concerning inadequate access control. This...

PT-2023-20636 · Ox Software Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue concerns a full-text autocomplete search that allows user-provided SQL syntax to be injected into SQL statements. Despite existing sanitization, this can be exploited to trigger...

Advisory ROSA-SA-2023-2203

Software: python 2.7.5 OS: rosa-server79 packageevrstring: python-2.7.5-93.res7 CVE-ID: CVE-2023-24329 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A problem in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blacklisting methods by providing a URL that starts with empty...

xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation (CVE-2022-25235)

xmltokimpl.c in Expat aka libexpat before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context...

The vulnerability of the application programming interface of the cloud platform for developing and deploying applications. VMware Tanzu Application Service for VMs (TAS for VMs) and the Isolation Segment management platform allow a malicious actor to gain unauthorized access to protected information.

The vulnerability of the application programming interface of a cloud platform for developing and deploying VMware Tanzu Application Service for VMs TAS for VMs and isolation segment management platform is related to the disclosure of administrator registration data in system audit logs during...

Inconsistent encoding of arrays in MetaTxLib

Lines of code Vulnerability details Bug Description According to the EIP-712 specification, arrays are encoded by concatenating its elements and passing the result to keccak256: The array values are encoded as the keccak256 hash of the concatenated encodeData of their contents i.e. the encoding o...

The vulnerability of the Envoy proxy server stems from a lack of mechanisms for encoding or filtering output data, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Envoy proxy server is related to the lack of mechanisms for encoding or filtering output data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

Cross-Site Scripting (XSS)

typo3/html-sanitizer is vulnerable to Cross-Site Scripting XSS. The vulnerability exists because a malicious text embedded in a noscript element was not encoded appropriately due to a serialization layer encoding bug, which allows an attacker to inject and execute arbitrary JavaScript when noscri...

CVE-2023-39151

Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperlinks, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control build log contents...

CVE-2023-20891

The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF...

Information disclosure

The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF...

CVE-2023-20891

The CVE-2023-20891 issue affects VMware Tanzu Application Service for VMs and Isolation Segment. A information-disclosure vulnerability arises from credentials being logged in hex encoding within platform system audit logs. A non-admin user with access to these logs could access hex-encoded CF AP...