Input validation

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another vulnerability...

CVE-2022-22143 Prototype Pollution

The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. Note: This vulnerability derives from an incomplete fix of another vulnerability...

Shopizer 跨站脚本漏洞

Shopizer is a Java-based e-commerce solution from the Shopizer team. 2.0 to 2.17.0 versions of Shopizer are vulnerable to a cross-site scripting vulnerability in which the file name under the "Manage Files" tab lacks validation filters for user-supplied and output data. An attacker could use this...

Rumble Mail Server 跨站脚本漏洞

Rumble Mail Server is a mail server suite for SMTP ESMTPSA, HTTP, POP3, and IMAP4v1 from Daniel Gruno's personal developer.Rumble Mail Server version 0.51.3135 is vulnerable to a cross-site scripting vulnerability that stems from the domain and path parameters are missing a data validation filter...

Attendance Management System跨站脚本漏洞

Sourcecodester Student Attendance Management System is an attendance management system used to maintain daily attendance records. A cross-site scripting vulnerability exists in Sourcecodester Student Attendance Management System version 1.0. The vulnerability stems from a lack of data validation...

Money Transfer Management System SQL Injection Vulnerability

A SQL injection vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from missing validation of external input SQL statements in the id parameter in admin/maintenance/managebranch.php and admin/maintenance/managefee.php...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. Ice Hrm version 30.0.0.OS is vulnerable to a cross-site scripting vulnerability caused by a lack of data validation filtering of user-supplied and output data in the "m" parameter of the user dashboard. An attacker could exploit this vulnerability to...

CVE-2021-23495

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the returnurl query parameter...

CVE-2021-23495

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the returnurl query parameter...

Open redirect

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the returnurl query parameter...

CVE-2021-23495

Summary: Karma (JavaScript test runner) before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter. Affected component: karma

CVE-2021-23495 Open Redirect

The package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the returnurl query parameter...

JetBrains Hub 代码问题漏洞

JetBrains Hub is a web-based application from JetBrains Czech Republic. JetBrains Hub has a server-side request forgery vulnerability that stems from the software's lack of validation for request forgery, which can be exploited by attackers to conduct server-side request forgery SSRF attacks...

CVE-2022-24368

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

SourceCodester Storage Unit Rental Management System SQL Injection Vulnerability

SourceCodester Storage Unit Rental Management System is a storage unit rental management system that helps manage storage unit rental business records and monitor their records. sourceCodester Storage Unit Rental Management A SQL injection vulnerability exists in the v1 version of the System. The...

Mysiteforme 跨站请求伪造漏洞

Mysiteforme is a permission management system. A cross-site request forgery vulnerability exists in mysiteforme, which stems from a lack of validation for cross-site request forgery in the backend blog administration. An attacker could use a forged malicious request to trick a victim into clickin...

CVE-2021-35969

Pexip Infinity before 26 allows temporary remote Denial of Service abort because of missing call-setup input validation...

Prototype Pollution

Overview convict is a package that expands on the standard pattern of configuring node.js applications in a way that is more robust and accessible to collaborators, who may have less interest in digging through imperative code in order to inspect or modify settings. By introducing a configuration...

CVE-2021-34922

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

CVE-2021-41789

In wifi driver, there is a possible system crash due to a missing validation check. This could lead to remote denial of service from a proximal attacker with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: GN20190426015; Issue ID: GN2019042601...