5509 matches found
CVE-2021-20280: Improper Neutralization of Input During Web Page Generation
Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...
CVE-2021-21381: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...
CVE-2020-35571: Improper Neutralization of Input During Web Page Generation
An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...
CVE-2021-23885: Improper Privilege Management
Privilege escalation vulnerability in McAfee Web Gateway MWG prior to 9.2.8 allows an authenticated user to gain elevated privileges through the User Interface and execute commands on the appliance via incorrect improper neutralization of user input in the troubleshooting page...
CVE-2021-22122
An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to perform a reflected cross site scripting attack XSS by injecting malicious payload in different vulnerable API...
CVE-2021-21434: Improper Neutralization of Input During Web Page Generation
Survey administrator can craft a survey in such way that malicious code can be executed in the agent interface i.e. another agent who wants to make changes in the survey. This issue affects: OTRS AG Survey 6.0.x version 6.0.20 and prior versions; 7.0.x version 7.0.19 and prior versions...
CVE-2020-7775
This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js...
CVE-2020-7775 Command Injection
This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js...
CVE-2020-7775
This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js...
PT-2021-12659
Name of the Vulnerable Software and Affected Versions: freediskspace affected versions not specified Description: The issue arises from improper neutralization of arguments in line 71 of freediskspace.js. This affects all versions of the package freediskspace. Recommendations: At the moment, ther...
CVE-2020-15690: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character...
Revive Adserver 5.1.0 Cross Site Scripting
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2021-002 ------------------------------------------------------------------------ https://www.revive-adserver.com/security/revive-sa-2021-002...
CVE-2020-28487: Improper Neutralization of Input During Web Page Generation
This affects the package vis-timeline before 7.4.4. An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application...
CVE-2020-27298: Improper Neutralization of Special Elements used in an OS Command
Philips Interventional Workspot Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live Release 1.0, ViewForum Release 6.3V1L10. The software constructs all or part of an OS command using externally influenced input from an upstream component but does no...
CVE-2020-28470: Improper Neutralization of Input During Web Page Generation
This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify function and then written into the HTML page...
Envira Gallery Lite 1.8.3.2 Cross Site Scripting
==== Tempest Security Intelligence - ADV-12/2020 ============================= Envira Gallery - Lite Edition - Version 1.8.3.2 Author: Rodolfo Tavares Tempest Security Intelligence - Recife, Pernambuco - Brazil ===== Table of Contents ================================================ • Overview •...
CVE-2020-35818: Improper Neutralization of Input During Web Page Generation
Certain NETGEAR devices are affected by stored XSS. This affects D7800 before 1.0.1.56, R7500v2 before 1.0.3.46, R7800 before 1.0.2.74, R8900 before 1.0.4.28, R9000 before 1.0.4.28, RAX120 before 1.0.0.78, RBR20 before 2.3.5.26, RBR20 before 2.3.5.26, RBS20 before 2.3.5.26, RBK40 before 2.3.5.30,...
CVE-2020-28857: Improper Neutralization of Input During Web Page Generation
OpenAsset Digital Asset Management DAM through 12.0.19, does not correctly sanitize user supplied input in multiple parameters and endpoints, allowing for stored cross-site scripting attacks...
CVE-2020-28860: Improper Neutralization of Special Elements used in an SQL Command
OpenAssetDigital Asset Management DAM through 12.0.19 does not correctly sanitize user supplied input, incorporating it into its SQL queries, allowing for authenticated blind SQL injection...