Leyka < 3.30 - Unauthenticated Stored XSS

The plugin does not sanitise and escape some parameters, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...

Yet Another Stars Rating < 3.1.3 - Subscriber+ Stored XSS

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Stored Cross-Site Scripting attacks...

CVE-2021-45478

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2...

CVE-2021-45477

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users. This issue affects Library Automation System: before 19.2...

Input validation

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2...

Input validation

Improper Handling of Parameters vulnerability in Bordam Information Technologies Library Automation System allows Collect Data as Provided by Users.This issue affects Library Automation System: before 19.2...

CVE-2021-45478

CVE-2021-45478 affects Yordam Library Automation System (Bordam Information Technologies) prior to version 19.2. The root cause is improper handling of parameters that enables collection of data supplied by users (high confidentiality impact). Documents consistently describe this vulnerability as...

SQL Injection in '/module/accounts/ajax.php'

Description There exists an SQL injection affecting the 'order'0'dir', start and length parameters located in the file /module/accounts/ajax.php Let's take a look at the following code: https://github.com/unilogies/bumsys/blob/9dc2de204116297a7e528c38bc3b1e89bf40f907/module/accounts/ajax.phpL1503...

XWiki Platform 代码注入漏洞

XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform that originates from an arbitrary script macro that can be injected via a URL request parameter in combination with other...

CVE-2023-25931

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which ha...

CVE-2023-25931 Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue

Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the clinician therapy application, which ha...

CVE-2023-25931

Medtronic Pelvic Health clinician apps (Micro Clinician A51200 and InterStim X Clinician A51300) installed on the Smart Programmer mobile device are affected by a password-related vulnerability (CVE-2023-25931) that could allow unauthorized control of the clinician therapy application. The issue ...

rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

Impact When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was...

GHSA-32GR-4CQ6-5W5Q rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

Impact When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code. Users who access the deliberately constructed URL are affected. Patches This vulnerability was...

SUSE-SU-2023:0586-1 Security update for nrpe

This update for nrpe fixes the following issues: - CVE-2015-4000: Fixed Logjam Attack by increasing the standard size of 512 bit dh parameters to 2048 bsc931600, bsc938906...

Fortinet FortiWeb Formatting String Error Vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A formatted string error vulnerability exist...

ASB-A-264598465

In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services...

CVE-2023-27292

An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters...

Open redirect

An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters...

kernel: stack overflow in do_proc_dointvec and proc_skip_spaces

A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system...