CVE-2020-14179

CVE-2020-14179 Esposizione di dati sensibili tramite l'endpoint /secure/QueryComponent!Default.jspa Priorità: Alta Versioni interessate: 8.6.0 | 8.8.0 | 8.5.5 | 8.9.0 | 8.10.0 | 8.11.0 Le versioni affette di Atlassian Jira Server e Data Center consentono ad attaccanti remoti non autenticati di...

google_gax

googlegax con patch Fork con patch di googlegax v0.4.1 per la compatibilità con Tesla = 1.18.3. Perché esiste questo fork Tesla 1.18.3 2 giugno 2026 ha introdotto una validazione rigorosa dei nomi dei campi multipart tramite assertquotedstringsafe!/2 come parte delle correzioni di sicurezza per...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

EUVD-2026-81047

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-92784 @refinedev/inferencer through 7.0.0 Code Injection via API Field Names

@refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page...

CVE-2026-92784

@refinedev/inferencer through version 7.0.0 (part of the refine framework) is vulnerable to code injection via API field names . The root cause is a failure to escape API field names when interpolating them into generated JSX source code . An attacker controlling the data provider can inject mali...

CVE-2026-76558

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-76558

The WP Import Export Lite WordPress plugin versions before 3.9.33 is vulnerable to a Stored DOM XSS vulnerability. The issue stems from the failure to escape custom field names retrieved from the database before they are inserted into the DOM of an administration screen. This allows users with a ...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

PT-2026-93283

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-76558: Improper Neutralization of Input During Web Page Generation

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in multer Vulnerability Details CVEID:CVE-2026-5038 DESCRIPTION: Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malform...

NPM: multer vulnerable to Denial of Service via crafted multipart field names

NPM: multer vulnerable to Denial of Service via crafted multipart field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

multer vulnerable to Denial of Service via crafted multipart field names

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...

GHSA-WC9G-MQFW-JRWM multer vulnerable to Denial of Service via crafted multipart field names

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the...

multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...

NPM: multer vulnerable to Denial of Service via oversized array index in field names

NPM: multer vulnerable to Denial of Service via oversized array index in field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

GHSA-535W-7CP7-47Q4 multer vulnerable to Denial of Service via oversized array index in field names

Impact multer is vulnerable to a Denial of Service DoS via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items4294967294 forces allocation of a maximum-length sparse array. A following field wi...