Grup Arge Energy and Control Systems SmartPower Energy Management System SQL注入漏洞

Grup Arge Energy and Control Systems SmartPower Energy Management System is a web-based system from Grup Arge Energy and Control Systems developed specifically to improve energy efficiency in organizations. A security vulnerability exists in Grup Arge Energy and Control Systems SmartPower Energy...

CVE-2023-0624

OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html...

CVE-2022-21948

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in paste allows remote attackers to place Javascript into SVG files. This issue affects: openSUSE paste paste version b57b9f87e303a3db9465776e657378e96845493b and prior versions...

Cross site scripting

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in paste allows remote attackers to place Javascript into SVG files. This issue affects: openSUSE paste paste version b57b9f87e303a3db9465776e657378e96845493b and prior versions...

USN-5843-1 tmux vulnerability

It was discovered that tmux incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service...

is-http2 操作系统命令注入漏洞

is-http2 is an application by Stefan Judis personal developer. A simple module for checking whether certain servers support HTTP/2. An operating system command injection vulnerability exists in is-http2, which stems from a lack of input cleanup or other checks and the use of sandboxing by the isH...

jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method

A Cross-site scripting XSS vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the ‘HTML’ function to inject Javascript into the page where that input is rendered, and have it delivered by the browser...

Ubuntu: Security Advisory (USN-5342-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2022-4092

An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input...

sinatra: Reflected File Download attack

A flaw was found in Sinatra, a domain-specific language for creating web applications in Ruby. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input...

GHSA-Q764-G6FM-555V Path traversal in spotipy

Summary If a malicious URI is passed to the library, the library can be tricked into performing an operation on a different API endpoint than intended. Details The code Spotipy uses to parse URIs and URLs accepts user data too liberally which allows a malicious user to insert arbitrary characters...

USN-5818-1 php7.2, php7.4, php8.1 vulnerability

It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

USN-5806-1 ruby2.3 vulnerability

Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi gem. An attacker could possibly use this issue to maliciously modify the response a user would receive from a vulnerable application...

Webapplication-Veganguide 跨站脚本漏洞

Webapplication-Veganguide is a vegetarian restaurant guide for individual developers. Webapplication-Veganguide suffers from a cross-site scripting vulnerability that stems from the fact that incorrect manipulation of the parameters country/city can lead to cross-site scripting...

PT-2023-7985 · One Identity +3 · Syslog-Ng +5

Name of the Vulnerable Software and Affected Versions: One Identity syslog-ng versions 3.0 through 3.37 syslog-ng Premium Edition version 7.0.30 syslog-ng Store Box version 6.10.0 Description: The issue is related to an integer overflow in the RFC3164 parser, which can be exploited by remote...

WordPress plugin Swifty Page Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

window-control 安全漏洞

window-control is a package from Bruno Robert's personal developer. It is designed to perform tasks similar to robot.js without mouse control, but without compiling external C++ code. A security vulnerability exists in window-control versions prior to 1.4.5, which stems from incorrect input and i...

PT-2023-14580 · Axiell · Axiell Iguana Cms

Name of the Vulnerable Software and Affected Versions: Axiell Iguana CMS affected versions not specified Description: A Local File Inclusion issue has been found in Axiell Iguana CMS. The problem arises from insufficient neutralisation of user input on the url parameter in the "Proxy.type.php" an...

CVE-2022-41336

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2, 5.1, 5.0 management interface may allow a remote authenticated attacker to perform a stored cross site scripting XSS attack via sending...

WordPress plugin WP User SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...