CVE-2021-23433: Improperly Controlled Modification of Object Prototype Attributes

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

PT-2021-15521

Name of the Vulnerable Software and Affected Versions algoliasearch-helper versions prior to 3.6.2 Description The issue arises from the use of the merge function in src/SearchParameters/index.js, specifically in the SearchParameters. parseNumbers function, without protection against prototype...

chalice (>=1.6.2, <=1.8.0), commit-helper (3.4.13) +6 more potentially affected by CVE-2021-3572 via pip (18.1.0)

pip PYPI version 18.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.6.2, =0.1.6, =0.0.3, =3.2.0, =4.0.0 Source cves: CVE-2021-3572 Source advisory: OSV:PYSEC-2021-437...

WordPress Booking.com Product Helper Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Booking.com Product Helper plugin in version 1.0....

Cloudera Hue Cross-Site Scripting Vulnerability

Cloudera Hue is a mature open source SQL helper for querying any database and data warehouse.A cross-site scripting vulnerability exists in Cloudera Hue version 4.6.0. An attacker can exploit the vulnerability to conduct cross-site scripting attacks via the type parameter...

Ubuntu 18.04 LTS / 20.04 LTS : Docker vulnerability (USN-5134-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-5134-1 advisory. An information disclosure issue was discovered in the command line interface of Docker. A misconfigured credential store could result in supplied...

CVE-2021-24645

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24645

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24645

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross site scripting

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24645

CVE-2021-24645 concerns the Booking.com Product Helper WordPress plugin prior to 1.0.2. The vulnerability is a Stored Cross-Site Scripting (XSS) in the Product Shortcode creation flow, caused by failure to sanitize and escape the Product Code. An attacker with admin+ privileges could inject XSS i...

CVE-2021-24645 Booking.com Product Helper < 1.0.2 - Admin+ Stored Cross-Site Scripting

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Booking.com Product Helper plugin in version 1.0....

CVE-2021-24645: Improper Neutralization of Input During Web Page Generation

The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16162

Name of the Vulnerable Software and Affected Versions Booking.com Product Helper WordPress plugin versions prior to 1.0.2 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of the Product Code when creating Produc...

DEBIAN-CVE-2011-4126

Race condition issues were found in Calibre at devices/linuxmounthelper.c allowing unprivileged users the ability to mount any device to anywhere...

DEBIAN-CVE-2011-4125

A untrusted search path issue was found in Calibre at devices/linuxmounthelper.c leading to the ability of unprivileged users to execute any program as root...

CVE-2011-4125

A untrusted search path issue was found in Calibre at devices/linuxmounthelper.c leading to the ability of unprivileged users to execute any program as root...

CVE-2011-4124

Input validation issues were found in Calibre at devices/linuxmounthelper.c which can lead to argument injection and elevation of privileges...

CVE-2011-4126

The CVE-2011-4126 issue concerns Calibre’s devices/linux_mount_helper.c, where a race condition can allow unprivileged users to mount any device to any location. Multiple connected sources (RH/CVE, NVD, OSV, UB Ubuntu, Debian, OSV–DEBIAN, CVE lists) corroborate the vulnerability’s technical scope...