Cross site scripting

A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument description with the input alertdocument.cookie leads to cross site scripting. The attack can be launched remotely...

PT-2024-15481 · Codeastro · Codeastro Vehicle Booking System

Name of the Vulnerable Software and Affected Versions: CodeAstro Vehicle Booking System version 1.0 Description: A problematic issue was found in the User Registration component, specifically in the file usr/usr-register.php. The manipulation of the Full Name, Last Name, or Address arguments with...

OESA-2023-1929 xstream security update

XStream is a simple library to serialize objects to XML and back again. A high level facade is supplied that simplifies common use cases. Custom objects can be serialized without need for specifying mappings. Speed and low memory footprint are a crucial part of the design, making it suitable for...

webkitgtk: Visiting a malicious website may lead to address bar spoofing.

A vulnerability was found in WebKitGTK. This flaw occurs due to an issue in the component URL Handler, which allows a remote attacker to manipulate an unknown input that can lead to clickjacking...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4j Vulnerability - CVE-2021-44228 :greenbook: - Int...

grafana: Spoofing of the originalUrl parameter of snapshots

A flaw was found in the grafana package. While creating a snapshot, an attacker may manipulate a hidden HTTP parameter to inject a malicious URL in the "Open original dashboard" button...

webkitgtk: Visiting a malicious website may lead to address bar spoofing.

A vulnerability was found in WebKitGTK. This flaw occurs due to an issue in the component URL Handler, which allows a remote attacker to manipulate an unknown input that can lead to clickjacking...

CVE-2023-5696

A vulnerability was found in CodeAstro Internet Banking System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file pagestransfermoney.php. The manipulation of the argument accountnumber with the input 357146928--alert9206!-- leads to cross site...

Cross site scripting

A vulnerability was found in app1pro Shopicial up to 20230830. It has been declared as problematic. This vulnerability affects unknown code of the file search. The manipulation of the argument from with the input comments'" leads to cross site scripting. The attack can be initiated remotely. The...

CVE-2023-4439

CVE-2023-4439 affects SourceCodester Card Holder Management System 1.0, specifically the Minus Value Handler. The issue is improper validation of a quantity input, allowing a remote attack. Documents consistently describe the vulnerability as involving unknown functionality in the Minus Value Han...

CVE-2023-37497

The Unica application exposes an API which accepts arbitrary XML input. By manipulating the given XML, an authenticated attacker with certain rights can successfully perform XML External Entity attacks XXE against the backend service...

Input validation

A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /sendorder.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial of service. The attack can be launched...

Performance Indicator System 跨站脚本漏洞

Performance Indicator System is a performance indicator system management system for nurhodelta17 individual developers. A cross-site scripting vulnerability exists in Performance Indicator System version 1.0, which stems from a problem in the file /admin/addproduct.php, where incorrect...

PT-2023-17038 · Sourcecodester · Sourcecodester Alphaware Simple E-Commerce System

Name of the Vulnerable Software and Affected Versions: SourceCodester Alphaware Simple E-Commerce System version 1.0 Description: A critical issue affects some unknown functionality of the file function/edit customer.php. The manipulation of the argument firstname/mi/lastname with the input a'...

CVE-2022-3219

GnuPG can be made to spin on a relatively small input by for example crafting a public key with thousands of signatures attached, compressed down to just a few KB...

SUSE CVE-2022-41966

XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for...

Symantec Identity Manager 跨站脚本漏洞

Symantec Identity Manager is an identity management system from Symantec Corporation. A security vulnerability exists in Symantec Identity Manager versions 14.3 CP3, 14.4.1, and 14.4.2, which stems from a user inputting a CRLF sequence that results in the returned response being split into two...

CVE-2023-23014

CVE-2023-23014 affects InventorySystem (InventorySystem.php) via XSS in the input fields through the commit e08fbbe17902146313501ed0b5feba81d58f455c (Apr 23, 2021). The base CVSS v3.1 score is 6.1 (MEDIUM) with Network attack vector, Low integrity/availability impact, and user interaction require...

Debian dla-3267 : libxstream-java - security update

The remote Debian 10 host has a package installed that is affected by a vulnerability as referenced in the dla-3267 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3267-1 [email protected] https://www.debian.org/lts/security/...

jenkins-plugin/junit: Stored XSS vulnerability in JUnit Plugin

A flaw was found in the JUnit Jenkins plugin. The manipulation with an unknown input leads to a Cross-site scripting vulnerability, impacting the integrity. This flaw allows an attacker to inject arbitrary HTML and script code into the website...