2034 matches found
PT-2022-26313 · Asus · Asus Nas-M25
Name of the Vulnerable Software and Affected Versions: Asus NAS-M25 versions through 1.0.1.7 Description: The issue is related to an improper neutralization of special elements used in an OS command, allowing an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie value...
CVE-2022-32923
A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, Safari 16.1, iOS 16.1 and iPadOS 16. Processing maliciously crafted web content may disclose internal states of the app...
WordPress plugin WP Humans.txt 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Input validation
This vulnerability exists in Milesight Video Management Systems VMS, all firmware versions prior to 40.7.0.79-r1, due to improper input handling at camera’s web-based management interface. A remote attacker could exploit this vulnerability by sending a specially crafted http request on the target...
PT-2022-6448 · Fortinet · Fortinac
Name of the Vulnerable Software and Affected Versions: Fortinet FortiNAC versions 8.3.7, 8.5.0 through 8.5.4, 8.6.0 through 8.6.5, 8.7.0 through 8.7.6, 8.8.0 through 8.8.11, 9.1.0 through 9.1.8, 9.2.0 through 9.2.5, 9.4.0 Description: The issue is related to an improper neutralization of input...
USN-5593-1 libzstd vulnerability
It was discovered that Zstandard incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code...
USN-5574-1 exim4 vulnerability
It was discovered that Exim incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code...
CVE-2022-2323
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions...
CVE-2022-2353
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...
Cisco Catalyst 跨站脚本漏洞
Cisco Catalyst is a series of switches from Cisco, Inc. A cross-site scripting vulnerability exists in the Cisco Catalyst 2940 Series, which stems from a failure to properly process user input and generate an error page that could be exploited by an attacker to execute arbitrary scripts on the we...
CVE-2022-22673
This issue was addressed with improved checks. This issue is fixed in iOS 15.5 and iPadOS 15.5. Processing a large input may lead to a denial of service...
GHSA-9CVR-8XQ4-2M73 Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
Multiple cross-site scripting XSS vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...
GHSA-HHX8-CR55-QCXX Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
An XSSI cross-site inclusion vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of erro...
CVE-2022-1190
Removed by vendor...
USN-5331-1 tcpdump vulnerabilities
It was discovered that tcpdump incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. CVE-2018-16301 It was discovered that tcpdump incorrectly handled certain captured data. An attacker could possibly use th...
darylldoyle svg-sanitizer 跨站脚本漏洞
darylldoyle svg-sanitizer is a SVG format file cleaning tool. A cross-site scripting vulnerability exists in Darylldoyle svg-sanitizer, which originates from the product's failure to securely handle special characters in user input data. The vulnerability can be exploited to execute client-side...
CVE-2021-3862
icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2021-4176
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
PT-2021-23395 · Unknown · Livehelperchat
Name of the Vulnerable Software and Affected Versions: livehelperchat affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software does not properly neutralize use...