Server side request forgery (ssrf)

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...

CVE-2021-23664

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...

CVE-2021-23664: Server-Side Request Forgery (SSRF)

The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...

PT-2021-16313 · WordPress · Stylish Cost Calculator

Name of the Vulnerable Software and Affected Versions: Stylish Cost Calculator WordPress plugin versions prior to 7.0.4 Description: The issue is related to the lack of authorization and CSRF checks on some AJAX actions in the plugin, which are available to authenticated users. This could allow a...

PT-2021-16109

Name of the Vulnerable Software and Affected Versions Translate WordPress – Google Language Translator WordPress plugin versions prior to 6.0.12 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of some settings...

Directory Traversal in startserver

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

GHSA-HQV3-QQ72-78CV Directory Traversal in startserver

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

CVE-2021-23430

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

CVE-2021-23430

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

Directory traversal

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

CVE-2021-23430

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

CVE-2021-23430 Directory Traversal

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

CVE-2021-23430

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

CVE-2021-23430: Improper Limitation of a Pathname to a Restricted Directory

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...

Cross-site Scripting (XSS)

Overview s-cart/core is a free Laravel e-commerce for business. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing sanitization in AdminCurrencyController. PoC Login as manager/administrator, then go to Localisation Currencies. When adding or editing...

PT-2021-16057

Name of the Vulnerable Software and Affected Versions Custom Login Redirect WordPress plugin version 1.0.0 Description The issue is related to the lack of a CSRF check when saving settings and the failure to sanitise or escape user input before outputting it back in the page. This leads to a Stor...

Directory Traversal

Overview startserver is a Yet another http server Affected versions of this package are vulnerable to Directory Traversal due to missing sanitization. PoC curl --path-as-is --url "http://localhost:8080/../../../../etc/passwd" Details A Directory Traversal attack also known as path traversal aims ...

GHSA-Q74R-4XW3-PPX9 Stored cross-site scripting in Grid component in Vaadin 7 and 8

Missing variable sanitization in Grid component in com.vaadin:vaadin-server versions 7.4.0 through 7.7.19 Vaadin 7.4.0 through 7.7.19, and 8.0.0 through 8.8.4 Vaadin 8.0.0 through 8.8.4 allows attacker to inject malicious JavaScript via unspecified vector. -...

CVE-2021-24159

Due to the lack of sanitization and lack of nonce protection on the custom CSS feature, an attacker could craft a request to inject malicious JavaScript on a site using the Contact Form 7 Style WordPress plugin through 3.1.9. If an attacker successfully tricked a site’s administrator into clickin...

Reflected XSS when renaming malicious file (NC-SA-2021-005)

Missing sanitization in Nextcloud Server 20.0.5 and prior allowed to perform a reflected XSS when saving html as file name and causing an error on rename e.g. by renaming to an existing file. The risk is mostly mitigated due to the strict Content-Security-Policy CSP of Nextcloud, and thus mainly...