6638 matches found
UBUNTU-CVE-2022-1497
Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page...
USN-5272-1 hdf5 vulnerabilities
It was discovered that HDF5 incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service...
USN-5527-2: Checkmk vulnerabilities
USN-5527-1 fixed vulnerabilities in Checkmk. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: It was discovered that Checkmk incorrectly handled authentication. An attacker could possibly use this issue to cause a race condition leading to information...
Vulnerability of the Cluster component: The general system for managing MySQL Cluster databases, which allows a hacker to cause a service failure.
Vulnerability of the Cluster component: General database management systems like MySQL Cluster are vulnerable due to insufficient validation of input data. Exploitation of this vulnerability can allow a malicious actor to cause service interruptions remotely...
CVE-2022-29057
A improper neutralization of input during web page generation 'cross-site scripting' in Fortinet FortiEDR version 5.1.0, 5.0.0 through 5.0.3 Patch 6 and 4.0.0 allows a remote authenticated attacker to perform a reflected cross site scripting attack XSS by injecting malicious payload into the...
PT-2022-5535 · D Link · D-Link Dir-1935
Name of the Vulnerable Software and Affected Versions: D-Link DIR-1935 version 1.03 Description: The issue is related to the SetIPv4FirewallSettings function in the web management interface of D-Link DIR-1935 routers, which fails to properly clean input data in a user-supplied string when handlin...
PT-2022-20575 · Jquery +5 · Jquery Ui +5
Name of the Vulnerable Software and Affected Versions: jQuery UI versions prior to 1.13.2 Moodle versions prior to 3.11.17-alt1 Description: jQuery UI, a collection of user interface interactions, effects, widgets, and themes built on jQuery, is susceptible to a cross-site scripting XSS issue...
USN-5519-1 python2.7, python3.10, python3.4, python3.5, python3.6, python3.8, python3.9 vulnerability
It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code...
USN-5519-1: Python vulnerability
It was discovered that Python incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code...
USN-5510-2 xorg-server, xorg-server-hwe-16.04 vulnerabilities
USN-5510-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain inputs. An attacker could use this issue to cause the server to crash,...
CVE-2022-22682
Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in Event Management in Synology Calendar before 2.4.5-10930 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
CVE-2022-2353
Prior to microweber/microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery, fetch contents from same-site and redirect a user...
Microweber 跨站请求伪造漏洞
Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site request forgery vulnerability exists in Microweber versions prior to v1.2.2...
PT-2022-16055 · Unknown · Microweber
Name of the Vulnerable Software and Affected Versions: microweber/microweber versions prior to 1.2.20 Description: The issue is due to improper neutralization of input, allowing an attacker to steal tokens and perform cross-site request forgery, fetch contents from the same site, and redirect a...
Improper handling of email input
Impact An attacker can pass a compromised input to the e-mail signin endpoint that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: [email protected], Before signing in, claim your money!. This was previously sent to...
The vulnerability in the LDAP Account Manager web application exists due to the lack of measures taken to neutralize special elements. This allows attackers to execute arbitrary code on the host by writing the web interface to the /lam/tmp/ directory.
The vulnerability of the LDAP Account Manager web application exists due to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the host by writing it into the web interface’s directory at /lam/tmp/...
PT-2022-20533 · Mermaid +1 · Mermaid +1
Name of the Vulnerable Software and Affected Versions: Mermaid versions prior to 9.1.3 Description: Mermaid is a JavaScript-based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker can inject arbitrary CSS...
nodejs: Prototype pollution via console.table properties
Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...
