CVE-2023-39461 Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability

Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to write arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required...

Cross-Site Scripting

github.com/baidu/openrasp is vulnerable to Cross-Site Scripting. The vulnerability is due to improper handling of input and lack of output sanitization in the redirect parameter on the /login page. This allows attacker to inject arbritrary javascript to be executed with the permissions of a user...

OESA-2024-1405 mozjs78 security update

SpiderMonkey is the code-name for Mozilla Firefox's C++ implementation of JavaScript. It is intended to be embedded in other applications that provide host environments for JavaScript. Security Fixes: When copying a network request from the developer tools panel as a curl command the output was n...

lollms-webui 安全漏洞

LoLLMs is a Web UI for a large language multi-model system by the individual developer Saifeddine ALOUI. A security vulnerability exists in lollms-webui that stems from inadequate cleaning and validation of model output data...

PT-2024-22360

Name of the Vulnerable Software and Affected Versions: KaTeX versions prior to 0.16.10 Description: KaTeX is a JavaScript library for TeX math rendering on the web. Users who render untrusted mathematical expressions could encounter malicious input using includegraphics that runs arbitrary...

Cross Site Scripting

sidekiq-unique-jobs is vulnerable to Cross Site Scripting XSS. The vulnerability is due to a missing input validation and output sanitization for the GET request parameters handled by the endpoints - /changelogs, /locks and /expiringlocks of the "admin" web UI. This can allow an attacker to...

Cross Site Scripting

Liferay Portal is vulnerable to Cross Site Scripting. The vulnerability is due to inadequate input validation and output sanitization on the Language Override edit screen, allowing remote attackers to inject arbitrary web script or HTML via the...

The vulnerability of the VMware Workspace One Access application management platform, related to the administration console of VMware Identity Manager (vIDM), involves redirecting URLs to an unreliable website. This allows a malicious user to redirect users to any arbitrary URL address.

The vulnerability of the VMware Workspace One Access application management platform, as well as the VMware Identity Manager administration consoles, is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow a malicious actor to redirect...

CVE-2023-1372

The WH Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters such as whhomepage, whtextshort, whtextfull and in versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

The vulnerability of the manage_record.php web application used for creating medical certificates, the Medical Certificate Generator App, allows a violator to execute arbitrary SQL code.

The vulnerability of the managerecord.php web application used for creating medical certificates in the Medical Certificate Generator App is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code...

GO-2023-1548 Repository access credential leak in github.com/argoproj/argo-cd/v2

Argo CD has an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API and therefor the UI or CL...

CVE-2023-25163 Argo CD leaks repository credentials in user-facing error messages and in logs

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error...

CVE-2023-25163 Argo CD leaks repository credentials in user-facing error messages and in logs

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error...

PT-2023-1394 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 2.6.0-rc1 through 2.6.0 Description: The issue is related to an output sanitization bug in Argo CD, which leaks repository access credentials in error messages. These error messages are visible to the user and are logged. The...

USN-5816-1 firefox vulnerabilities

Niklas Baumstark discovered that a compromised web child process of Firefox could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. An attacker could potentially exploits this to obtain sensitive information. CVE-2023-23597 Tom...

CVE-2022-3895

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

CVE-2022-3895 Potential XSS in common user interface component library

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

CVE-2022-3895 Potential XSS in common user interface component library

Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...

CVE-2022-3895

The CVE-2022-3895 entry describes a cross-site scripting (XSS) vulnerability in the Common UI Component: some UI elements do not properly sanitize output, enabling arbitrary HTML. Affected software is the Common User Interface Component (BlueSpice context implied by related records); root cause i...

BlueSpice 跨站脚本漏洞

BlueSpice is free Wiki software from BlueSpice based on the MediaWiki engine. BlueSpice suffers from a cross-site scripting vulnerability that stems from the fact that some of the UI elements of its Common User Interface component are not properly sanitized for output, and are therefore prone to...