CVE-2024-38166

CVE-2024-38166 is a cross-site scripting (XSS) vulnerability in Microsoft Dynamics 365 (on-premises and related Dynamics components) caused by improper neutralization of input during web page generation. An unauthenticated attacker can exploit this weakness to spoof the user interface or execute ...

CVE-2024-7552

DataGear up to 5.0.0 is affected in the Data Schema Page component, specifically the function evaluateVariableExpression in ConversionSqlParamValueMapper.java. The issue is an improper neutralization of special elements used in an expression language statement, enabling a remote, potentially high...

CVE-2024-7552

A vulnerability was found in DataGear up to 5.0.0. It has been declared as critical. Affected by this vulnerability is the function evaluateVariableExpression of the file ConversionSqlParamValueMapper.java of the component Data Schema Page. The manipulation leads to improper neutralization of...

CVE-2024-41911

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation...

CVE-2024-41911

CVE-2024-41911 affects HP Poly Clariti Manager devices (firmware up to 10.10.2.2). Root cause: input not properly neutralized during web page generation, enabling stored XSS in the web UI. Reported impact is a web‑page level vulnerability; remediation is to update to firmware >10.10.2.2, speci...

CVE-2024-41911

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation...

CVE-2024-41911

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation...

GHSA-4H4P-553M-46QH Gitea Cross-site Scripting Vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gitea Gitea Open Source Git Server allows Stored XSS.This issue affects Gitea Open Source Git Server: 1.22.0...

CVE-2024-41911: Improper Neutralization of Input During Web Page Generation

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The flaw does not properly neutralize input during a web page generation...

Gitea cross-site scripting vulnerability

Gitea is a lightweight Go-based git service developed by the Gitea community. A security vulnerability exists in Gitea version 1.22.0 that stems from improper input neutralization during page generation, which could lead to a stored cross-site scripting attack...

CVE-2024-7082: Improper Neutralization of Input During Web Page Generation

The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks...

CVE-2024-38166: Improper Neutralization of Input During Web Page Generation

An unauthenticated attacker can exploit improper neutralization of input during web page generation in Microsoft Dynamics 365 to spoof over a network by tricking a user to click on a link...

Security Bulletin: IBM Storage Ceph is vulnerable to Improper Output Neutralization for Logs in the RHEL UBI (CVE-2023-28486)

Summary RHEL UBI is used by IBM Storage Ceph as the base operating system. This bulletin identifies the steps to take to address the vulnerability in the RHEL UBI. CVE-2023-28486. Vulnerability Details CVEID:CVE-2023-28486 DESCRIPTION: Sudo Project Sudo could allow a remote attacker to obtain...

OpenText ALM Octane security vulnerabilities

OpenText ALM Octane is a quality management software from OpenText Canada. It includes integration planning, continuous integration, test management and release management. A security vulnerability exists in OpenText ALM Octane versions prior to 23.4 that stems from the presence of an incorrect...

CVE-2024-41380: Improper Neutralization of Input During Web Page Generation

microweber 2.0.16 was discovered to contain a Cross Site Scripting XSS vulnerability via userfiles\modules\tags\addtaggingtagged.php...

PT-2024-28260 · Horizon Business Services Inc. · Caterease

Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command...

CVE-2024-39631

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Contest Gallery allows Stored XSS.This issue affects Contest Gallery: from n/a through 23.1.2...

CVE-2024-39626

CVE-2024-39626 affects WordPress Pretty Simple Popup Builder; Stored XSS due to Improper Neutralization of Input During Web Page Generation. Affected: plugin Pretty Simple Popup Builder

CVE-2024-39643

CVE-2024-39643 is a stored XSS vulnerability in RegistrationMagic Forms (RegistrationMagic plugin) affecting versions up to 6.0.0.1. The issue stems from improper neutralization of input during web page generation. Red Hat/patchstack references confirm a fix in version 6.0.0.2. Public details in ...

CVE-2024-39668

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in petesheppard84 Extensions for Elementor allows Stored XSS.This issue affects Extensions for Elementor: from n/a through 2.0.31...