Information Disclosure

apachesuperset is vulnerable to Information Disclosure. A remote authenticated attacker with read access to a specific database can add subqueries to the WHERE and HAVING fields, resulting in references to tables on the same database that the attacker should not have access to. The perimeter to...

Path Traversal

github.com/whyrusleeping/tar-utils is vulnerable to Path Traversal. The vulnerability exists because the elems parameter in the Sanitize function of extractor.go does not properly sanitize the relative file paths, allowing an attacker to write arbitrary files outside the expected directory...

CVE-2022-3904

The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics...

CVE-2023-0302 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in radareorg/radare2

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository radareorg/radare2 prior to 5.8.2...

CVE-2022-4374

The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

GHSA-H857-2G56-468G @mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS)

Impact The sanitize-svg package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting XSS. In doing so, literal -tags and on-event handlers were detected: typescript ... const svgEl = div.firstElementChild! const attributes = Array.fromsvgEl.attributes.map name = name const...

@mattkrick/sanitize-svg vulnerable to Cross-Site Scripting (XSS)

Impact The sanitize-svg package uses a deny-list-pattern to sanitize SVGs to prevent cross-site scripting XSS. In doing so, literal -tags and on-event handlers were detected: typescript ... const svgEl = div.firstElementChild! const attributes = Array.fromsvgEl.attributes.map name = name const...

K000130469: node.js systeminformation vulnerability CVE-2021-21315

Security Advisory Description The System Information Library for Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Proble...

CVE-2023-22461

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

Cross site scripting

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461 sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS)

The sanitize-svg package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal -tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on sanitize-sv...

CVE-2023-22461

CVE-2023-22461 concerns the sanitizer package sanitize-svg . The issue arises from a deny-list approach that fails to block certain vectors, allowing embedded JavaScript via literal [removed] tags or on-* attributes in SVGs. The vulnerability affects versions prior to 0.4.0; a patch was released ...

sanitize-svg 安全漏洞

sanitize-svg is a small SVG sanitizer to prevent XSS attacks. A security vulnerability exists in versions of sanitize-svg prior to 0.4.0 that stems from its use of deny-list mode to sanitize svg to prevent cross-site scripting, but an attacker can cause downstream software that relies on it to...

CVE-2022-4372 Web Invoice <= 2.1.3 - Authenticated SQLi

The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as...

PYSEC-2022-43007

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository ikus060/rdiffweb prior to 2.5.5...

U.S. Department of State: xss and html injection on ( https://labs.history.state.gov)

Possible XSS and HTML injection vulnerabilities were found on the website https://labs.history.state.gov through the "id" parameter, as user input was not sanitized and the website was using a vulnerable version of the jQuery library. Attackers could have exploited these vulnerabilities to execut...

CVE-2022-4112

The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-32763

A cross-site scripting xss sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...