8082 matches found
The vulnerability of the jQuery library arises from insufficient cleaning of data provided by users when elements of the <option> type are passed. This allows attackers to perform cross-site scripting attacks.
The vulnerability of the jQuery library exists due to insufficient cleaning of the data provided by the user when elements with the tag are passed to jQuery’s DOM methods. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
accel-mma84 (>=0.2.0-beta.1, <=0.2.0), bus (>=0.2.0, <=2.2.3) +14 more potentially affected by CVE-2020-36219 via atomic-option (0.1.2)
atomic-option CARGO version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on atomic-option and may be impacted: - accel-mma84 =0.2.0-beta.1, =0.2.0, =0.0.1, =0.7.0, =0.2.5, =1.0.0, =0.3.0-beta.1, =0.1.0, =0.3.0 and more Source cves: CVE-2020-36219...
PT-2020-17591
Name of the Vulnerable Software and Affected Versions atomic-option crate through 2020-10-31 Description The issue concerns the atomic-option crate, where AtomicOption unconditionally implements Sync. This allows moving non-Sync types, such as Rc or Arc, across thread boundaries, potentially...
Exploit for OS Command Injection in Oscommerce
PoC exploit for CVE-2020-27976, an authenticated remote code exe...
Prototype Pollution
chart.js is vulnerable to prototype pollution. The vulnerability exists through the lack of sanitization of the options parameter, allowing an attacker to inject and overwrite arbitrary properties...
CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting
Exploit Title: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting Date: 30/10/2020 Exploit Author: Vyshnav NK Vendor Homepage: https://projectworlds.in/ Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip Version: 1.0 Tested on: Window...
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
CVE-2020-27976
osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php, a from POST parameter can be passed to the application. This affects the PHP mail function, and the sendmail -f option...
PT-2020-6036
Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.94.2 Description The issue is related to errors in privilege management. It allows an attacker to potentially elevate privileges in the system by exploiting the vulnerability, which can lead to a denial of service...
pro-option.proiwebsites.com Cross Site Scripting vulnerability OBB-1420246
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-1661
On Juniper Networks Junos OS devices configured as a DHCP forwarder, the Juniper Networks Dynamic Host Configuration Protocol Daemon jdhcp process might crash when receiving a malformed DHCP packet. This issue only affects devices configured as DHCP forwarder with forward-only option, that forwar...
Default configuration
The system console configuration option 'log-out-on-disconnect' In Juniper Networks Junos OS Evolved fails to log out an active CLI session when the console cable is disconnected. This could allow a malicious attacker with physical access to the console the ability to resume a previous interactiv...
Qualys Policy Compliance Plugin for Jenkins Now Available
Various factors may introduce vulnerabilities in a product during its lifecycle, resulting in a drift from the required compliance status. Hence, it is of utmost importance that security is baked into the product at every stage of development and possibilities of security gaps are ruled out. CI/C...
Prototype Pollution
Overview chart.js is a Simple HTML5 charts using the canvas element. Affected versions of this package are vulnerable to Prototype Pollution. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options or the defaults options are deep...
The vulnerability of the iconv utility in the GNU C Library (glibc) system library arises from insufficient input validation, allowing attackers to trigger a service failure.
The vulnerability of the iconv utility in the GNU C Library glibc is related to insufficient input validation. Exploiting this vulnerability could allow a malicious actor to cause service failures when invoking the iconv utility with the “-c” option...
PT-2021-13852 · Stunnel +9 · Stunnel +9
Name of the Vulnerable Software and Affected Versions: stunnel versions prior to 5.57 Description: A flaw was found in stunnel where it improperly validates client certificates when it is configured to use both redirect and verifyChain options. This flaw allows an attacker with a certificate sign...
jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods
A flaw was found in jQuery. HTML containing \ elements from untrusted sources are passed, even after sanitizing, to one of jQuery's DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity...
tigervnc security and bug fix update
1.8.0-21 - Add upstream patch needed because of previous security fixes Resolves: bz1826822 1.8.0-20 - Fix stack buffer overflow in CMsgReader::readSetCursor Resolves: bz1791773 - Fix heap buffer overflow in DecodeManager::decodeRect Resolves: bz1791768 - Fix heap buffer overflow in...
PT-2020-15811 · Powerdns +1 · Powerdns Authoritative +2
Name of the Vulnerable Software and Affected Versions: PowerDNS Authoritative versions prior to 4.3.0 Description: A denial of service issue was discovered when the --enable-experimental-gss-tsig option is used. This allows a remote, unauthenticated attacker to cause a denial of service by sendin...
