CVE-2020-7749 Server-side Request Forgery (SSRF)

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749

The CVE-2020-7749 issue affects all versions of osm-static-maps where user input is passed directly to a template without escaping ({{{ ... }}}). This enables injection of arbitrary HTML/JS, leading to XSS in the rendered page and, in server contexts (e.g., Puppeteer), potential SSRF and Local Fi...

CVE-2020-7749

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749: Improper Neutralization of Special Elements in Output Used by a Downstream Component

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

PT-2020-19765

Name of the Vulnerable Software and Affected Versions osm-static-maps versions prior to 3.9.0 Description The issue arises from user input being passed directly to a template without proper escaping, using ... . This allows an attacker to inject arbitrary HTML or JavaScript code. Depending on the...

Server-side Request Forgery (SSRF)

Overview osm-static-maps is a Create a static image of a map with the features you want Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an...

datacube (1.6.2), osm-export-tool (0.0.17) +1 more potentially affected by CVE-2019-17545 via gdal (2.3.3)

gdal PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - datacube 1.6.2 - osm-export-tool 0.0.17 - pysy =0.0.8, =0.0.10 Source cves: CVE-2019-17545 Source advisory: OSV:PYSEC-2019-241...

evaporation (>=0.1.0, <=1.0.0), hspatial (>=0.1.0, <=2.1.3) +4 more potentially affected by CVE-2019-17545 via gdal (2.4.4)

gdal PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on gdal and may be impacted: - evaporation =0.1.0, =0.1.0, =0.0.4, =1.0.16, =0.9.0, =0.9.1 Source cves: CVE-2019-17545 Source advisory: OSV:PYSEC-2019-241...

CVE-2019-17504

An issue was discovered in Kirona Dynamic Resource Scheduling DRS 5.5.3.5. A reflected Cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script via the /osm/report/ password parameter...

PT-2019-15176

Name of the Vulnerable Software and Affected Versions Kirona Dynamic Resource Scheduling DRS version 5.5.3.5 Description An issue in Kirona Dynamic Resource Scheduling DRS allows an unauthenticated user to access the "/osm/REGISTER.cmd" also known as "/osm tiles/REGISTER.cmd" endpoint directly...

CVE-2019-17504: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Kirona Dynamic Resource Scheduling DRS 5.5.3.5. A reflected Cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script via the /osm/report/ password parameter...

PT-2019-15177

Name of the Vulnerable Software and Affected Versions Kirona Dynamic Resource Scheduling DRS version 5.5.3.5 Description A reflected Cross-site scripting XSS issue allows remote attackers to inject arbitrary web script. This is achieved via the "password" parameter in the "/osm/report/" API...

OSM Offline Maps Android Wear - Apache license, LGPL license vulnerabilities

HackApp vulnerability scanner discovered that application OSM Offline Maps Android Wear published at the 'play' market has multiple vulnerabilities...

Fedora 20 : ikiwiki-3.20140125-1.fc20 (2014-1747)

Update to the latest stable version. Changes in ikiwiki 3.20140125 : - inline: Allow overriding the title of the feed. Closes: http://bugs.debian.org/735123 Thanks, Christophe Rhodes - osm: Escape name parameter. Closes: http://bugs.debian.org/731797 Changes in ikiwiki 3.20140102 : - aggregate:...

CVE-2012-1647

Multiple cross-site scripting XSS vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via 1 $SERVER'HTTPHOST' or 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via 1 $SERVER'HTTPHOST' or 2...

CVE-2012-1647

CVE-2012-1647 affects the MediaFront Drupal module (Drupal 6.x: 6.x-1.x prior to 6.x-1.5; Drupal 7.x: 7.x-1.x prior to 7.x-1.5). The vulnerability is cross-site scripting via input in PHP library handling the stand-alone OSM Player, specifically through $_SERVER["HTTP_HOST"], $_SERVER["SCRIPT_NAM...

CVE-2012-1647

Multiple cross-site scripting XSS vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via 1 $SERVER'HTTPHOST' or 2...

CVE-2012-1647

Multiple cross-site scripting XSS vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via 1 $SERVER'HTTPHOST' or 2...