4275 matches found
PT-2021-10759 · Akaunting · Akaunting
Name of the Vulnerable Software and Affected Versions: Akaunting versions 2.0.9 and earlier Description: The issue concerns a CSV injection vulnerability in the Item name field of the export function. Attackers can inject arbitrary code into the name parameter, potentially leading to code executi...
CVE-2020-22390: Improper Neutralization of Formula Elements in a CSV File
Akaunting = 2.0.9 is vulnerable to CSV injection in the Item name field, export function. Attackers can inject arbitrary code into the name parameter and perform code execution when the crafted file is opened...
OSV-2021-850 Heap-buffer-overflow in proto_item_append_text
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=35102 Crash type: Heap-buffer-overflow READ 8 Crash state: protoitemappendtext dissectpfcp3gppenterpriseies calldissectorwork...
PT-2021-28301
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow READ 8 crash has been reported. The crash involves the proto item append text and dissect pfcp 3gpp enterprise ies functions, as...
Cross-Site Scripting (XSS)
plone is vulnerable to cross-site scripting. The vulnerability exists due to the mishandling of the full name during rendering of the ownership tab of a content item...
CVE-2021-33508
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...
Code injection
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...
PYSEC-2021-80
Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item...
CVE-2021-33508
The CVE-2021-33508 entry describes a XSS vulnerability in Plone versions up to 5.2.4 where the user’s full name is mishandled during rendering of the ownership tab, enabling cross-site scripting. Affected product: Plone CMS (up to 5.2.4). Root cause: improper handling of the fullname field in the...
The vulnerability of the Template and GTIN search components in the Oracle Product Hub system, a business automation solution from Oracle E-Business Suite, allows unauthorized access to devices by attackers.
The vulnerability of the Template sub-component and the GTIN search component of the Oracle Product Hub system, a business automation system within the Oracle E-Business Suite, is related to errors in the code. Exploiting this vulnerability could allow an attacker, operating remotely, to gain...
CVE-2021-21650
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled...
CVE-2021-21650
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled...
CVE-2021-21650
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled...
CVE-2021-30174
RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks...
Missing permission checks in s3 allow obtaining metadata about artifacts
s3 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models. This allows attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled. s3 0.11.7 requires...
CVE-2021-21650: Undefined Security Weakness
Jenkins S3 publisher Plugin 0.11.6 and earlier does not perform Run/Artifacts permission checks in various HTTP endpoints and API models, allowing attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled...
PT-2021-6721 · Unknown +1 · Cgal Libcgal +1
Name of the Vulnerable Software and Affected Versions: CGAL libcgal version 5.1.1 Description: A code execution vulnerability exists in the Nef polygon-parsing functionality. An out-of-bounds read vulnerability is present in the SNC io parser::read sface function, specifically in the store sm...
CVE-2020-28945
OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature, such as !http://onerror=Function.constructor, in a Notes item...