6053 matches found
Command Execution Vulnerability in HC Community Property Management System of Hefei Six Out Network Technology Co.
HC neighborhood property management system is initiated by the java110 team in April 2017 front and back end separation , distributed architecture open source projects. Hefei Six Out Network Technology Co. HC community property management system has a command execution vulnerability that can be...
CVE-2021-22871
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting XSS vulnerability...
PT-2021-15244
Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 5.1.0 Description The issue allows any user with a manager account to store possibly malicious content in the URL website property. This content is then displayed unsanitized in the affiliate-preview.php tag...
CVE-2021-22871: Improper Neutralization of Input During Web Page Generation
Revive Adserver before 5.1.0 permits any user with a manager account to store possibly malicious content in the URL website property, which is then displayed unsanitized in the affiliate-preview.php tag generation screen, leading to a persistent cross-site scripting XSS vulnerability...
PT-2021-27405
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read, as indicated by a crash report. The crash involves functions such as cdf file property info, cdf fil...
Path traversal vulnerability in agent names
Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override unrelated config.xml files. If the global config.xml file is replaced, Jenkins will start up with unsafe legacy defaults after a restart. Jenkins...
Excessive memory allocation in graph URLs leads to denial of service
Jenkins renders several different graphs for features like agent and label usage statistics, memory usage, or various plugin-provided statistics. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit the graph size provided as query parameters. This allows attackers to request or to...
Prototype Pollution
Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source. POC // compile the template var s2 = 'a/." ||...
XWiki Platform has unspecified vulnerabilities
XWiki Platform is a set of wiki platforms for creating web collaboration applications from the French company XWiki Xwiki. XWiki Platform has a security vulnerability that stems from incorrect handling of escapes in the display of properties. No details of the vulnerability are currently availabl...
CVE-2020-28282
A flaw was found in nodejs-getobject. The set function does not check for the type of object before assigning value to the property allowing an attacker to create a non-existent property or allow the manipulation of the property which could lead to a denial of service or a remote code execution...
CVE-2020-13654
XWiki Platform before 12.8 mishandles escaping in the property displayer...
CVE-2020-13654
XWiki Platform before 12.8 mishandles escaping in the property displayer...
CVE-2020-13654
XWiki Platform before 12.8 mishandles escaping in the property displayer...
PT-2020-13641 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 12.8 Description: The issue is related to the mishandling of escaping in the property displayer. Recommendations: For versions prior to 12.8, update to version 12.8 or later to resolve the issue...
CVE-2020-13654
XWiki Platform before 12.8 mishandles escaping in the property displayer...
CVE-2020-13654
CVE-2020-13654 affects XWiki Platform prior to 12.8, where the property displayer mishandles escaping. The root cause is improper escaping in the property displayer, with impact stated as confidentially high/partial and no explicit exploitation details in the provided materials. Remediation refer...
CVE-2020-13654
XWiki Platform before 12.8 mishandles escaping in the property displayer...
CVE-2020-13654: Improper Encoding or Escaping of Output
XWiki Platform before 12.8 mishandles escaping in the property displayer...
Bohan Weiye (Beijing) Technology Co., Ltd. community arterial property management integrated management and control cloud service platform has logic flaws and vulnerabilities
Bohanweiye Beijing Technology Co., Ltd. is a comprehensive solution provider of mobile Internet of Things IoT. A logic flaw exists in the Community Artery Property Management Integrated Control Cloud Service Platform of Bohan Weiye Beijing Technology Co. An attacker can use the vulnerability to l...