Mozilla: Quoting from an HTML email with certain tags will trigger network requests and load remote content, regardless of a configuration to block remote content

The Mozilla Foundation Security Advisory describes this flaw as: If a Thunderbird user quoted from an HTML email and the email contained either a video tag with the poster attribute or an object tag with a data attribute, a network request to the referenced remote URL was performed regardless of ...

Quote-O-Matic <= 1.0.5 - Admin+ SQLi

The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. PoC https://example.com/wp-admin/edit.php?page=quote-o-matic.php=qomID+AND+SELECT+3477+FROM+SELECTSLEEP5DhVP...

Quote-O-Matic <= 1.0.5 - Admin+ SQLi

The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. https://example.com/wp-admin/edit.php?page=quote-o-matic.php&sortby=qomID+AND+SELECT+3477+FROM+SELECTSLEEP5DhVP...

python-oslo-utils: incorrect password masking in debug output

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote " in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext...

Cross site scripting

A vulnerability was found in SourceCodester Sanitization Management System and classified as problematic. This issue affects some unknown processing of the file php-sms/?p=requestquote. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-213449...

Any use of fee-on-transfer tokens as quote tokens in auctions will result in freeze or loss of funds for users.

Lines of code Vulnerability details Description SIZE auctions do not support fee-on-transfer tokens. The platform rejects taxed baseToken during createAuction: // Passes https://github.com/transmissions11/solmate/blob/main/src/utils/SafeTransferLib.solL9 // Transfer base tokens to auction contrac...

CVE-2022-43352

Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=deletequote...

Sanitization Management System SQL注入漏洞

Sanitization Management System is a sanitization management system by Carlo Montero Personal Developer. A security vulnerability exists in Sanitization Management System v1.0, which stems from the id parameter of its /php-sms/classes/Master.php?f=deletequote component that allows an attacker to...

Sanitization Management System 安全漏洞

Sanitization Management System is a sanitization management system by Carlo Montero Personal Developer. A security vulnerability exists in Sanitization Management System, which stems from an SQL injection caused by the manipulation of the parameter id by an unknown function in its file...

PT-2022-7564 · Unknown +12 · Pdo Sqlite +12

Name of the Vulnerable Software and Affected Versions: PHP versions 8.0. through 8.0.26 PHP versions 8.1. through 8.1.14 PHP versions 8.2. through 8.2.1 Description: The issue occurs due to an uncaught integer overflow in the PDO::quote function of PDO SQLite, which can return an improperly quote...

Dart 安全漏洞

Dart is an open source programming language. A security vulnerability exists in Dart versions prior to 2.18 and prior to 3.30 that stems from the use of RFC 3986 syntax for its Dart URI class, which results in an incompatibility with the "" character in the uri, which could lead to bypassing...

CVE-2022-3519

A vulnerability classified as problematic was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Quote Requests Tab. The manipulation of the argument Manage Remarks leads to cross site scripting. The attack can b...

Cross site scripting

A vulnerability classified as problematic was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Quote Requests Tab. The manipulation of the argument Manage Remarks leads to cross site scripting. The attack can b...

CVE-2022-3519 SourceCodester Sanitization Management System Quote Requests Tab cross site scripting

A vulnerability classified as problematic was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Quote Requests Tab. The manipulation of the argument Manage Remarks leads to cross site scripting. The attack can b...

PT-2022-22621 · Sourcecodester · Sourcecodester Sanitization Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Sanitization Management System version 1.0 Description: A problematic issue was found in the Quote Requests Tab component, where the manipulation of the Manage Remarks argument leads to cross-site scripting. The attack can be...

CVE-2022-3519: Improper Neutralization

A vulnerability classified as problematic was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Quote Requests Tab. The manipulation of the argument Manage Remarks leads to cross site scripting. The attack can b...

CVE-2022-39232

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete...

CVE-2022-39232 Discourse vulnerable to incomplete quote causing a topic to crash in the browser

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete...

CVE-2022-39232 Discourse vulnerable to incomplete quote causing a topic to crash in the browser

Discourse is an open source discussion platform. Starting with version 2.9.0.beta5 and prior to version 2.9.0.beta10, an incomplete quote can generate a JavaScript error which will crash the current page in the browser in some cases. Version 2.9.0.beta10 added a fix and tests to ensure incomplete...

CVE-2022-39232

CVE-2022-39232 affects the Discourse open-source discussion platform. The issue occurs in Discourse versions 2.9.0.beta5 through 2.9.0.beta9 where an incomplete quote can generate a JavaScript error that crashes the current browser page. A fix was introduced in 2.9.0.beta10, with tests to ensure ...