CVE-2024-4099: Improper Encoding or Escaping of Output

An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection...

CVE-2024-7873: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Encoding or Escaping of Output, CWE - 83 Improper Neutralization of Script in Attributes in a Web Page vulnerability in Veribilim Software Veribase Order allows Stored XSS, Cross-Site Scripting XSS...

Improper Encoding (Escaping Of Output)

Apache Airflow is vulnerable to Improper Encoding Escaping of Output. The vulnerability is due to the example DAG exampleinleteventextra.py allowing authenticated attackers with DAG trigger permissions to execute arbitrary commands...

CVE-2024-45299: Improper Encoding or Escaping of Output

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

CVE-2024-38177: Improper Encoding or Escaping of Output

Windows App Installer Spoofing Vulnerability...

CVE-2024-6329: Improper Encoding or Escaping of Output

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded...

Cross-Site Scripting (XSS)

typo3/cms is vulnerable to Cross-Site Scripting XSS.The vulnerability is caused due to improper encoding of editor input, allowing authenticated editors to inject arbitrary HTML...

CVE-2024-39929: Improper Encoding or Escaping of Output

Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mimefilename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users...

CVE-2024-38475: Improper Encoding or Escaping of Output

Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not intentionally/directly reachable by any URL, resulting in code execution or source code disclosure...

CVE-2024-38473: Improper Encoding or Escaping of Output

Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. Users are recommended to upgrade to version 2.4.60, which fixes this issue...

CVE-2024-27629: Improper Encoding or Escaping of Output

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaped and injected into a system call when certain types of compression are used...

Improper Encoding Or Escaping Of Output

php81 is vulnerable to Improper Encoding or Escaping of Output. The vulnerability is due to insufficient escaping when using the procopen command with array syntax, allowing malicious users to execute arbitrary commands in the Windows shell by supplying controlled arguments...

CVE-2024-5585: Improper Encoding or Escaping of Output

In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using procopen command with array syntax, due to insufficient escaping, if the arguments of the executed command ar...

Cross-site Scripting (XSS)

typo3/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of user input, allowing authenticated editors to inject arbitrary HTML or JavaScript...

Cross-site Scripting (XSS)

typo3/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of editor input in the search result view, allowing authenticated editors to inject arbitrary HTML...

PT-2024-40099

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS affected versions not specified Description: The issue arises from the failure to properly encode user input, making several parts of the TYPO3 CMS susceptible to Cross-Site Scripting. Recommendations: At the moment, there is no...

PT-2024-40050

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue is related to the bookmark toolbar, which is susceptible to Cross-Site Scripting due to improper encoding of incoming data. Recommendations At the moment, there is no informatio...

PT-2024-40196

Name of the Vulnerable Software and Affected Versions: CSS styled content component affected versions not specified Description: The CSS styled content component is susceptible to Cross-Site Scripting due to improper encoding of user input. This allows authenticated editors to inject arbitrary HT...

PT-2024-40148 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue arises from the failure to properly encode information from external sources. Specifically, the language pack handling in the install tool is susceptible to cross-site...

Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper encoding of validation messages in certain FormField classes, which can present invalid content as part of the validation response resulting in XSS...