5901 matches found
CSV Injection
kevinpapst/kimai2 is vulnerable to CSV injection. The vulnerability is possible because the library does not sanitize the $desc parameter, which allows an attacker to inject malicious input...
Photo Gallery < 1.6.3 - Reflected Cross-Site Scripting
The plugin does not properly sanitize the $GET'imageurl' variable, which is reflected back to the users when executing the editimagebwg AJAX action. PoC...
Path Traversal: 'dir/../../filename' in moment.locale
Impact This vulnerability impacts npm server users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale. Patches This problem is patched in 2.29.2, and the patch can be applied to all affected versions from 1.0.1 up until 2.29.1, inclusive...
GHSA-8HFJ-J24R-96C4 Path Traversal: 'dir/../../filename' in moment.locale
Impact This vulnerability impacts npm server users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale. Patches This problem is patched in 2.29.2, and the patch can be applied to all affected versions from 1.0.1 up until 2.29.1, inclusive...
UBUNTU-CVE-2022-24785
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm server users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This...
Path traversal
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm server users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This...
CVE-2022-24785 Path Traversal in Moment.js
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm server users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This...
PT-2022-16878
Name of the Vulnerable Software and Affected Versions Moment.js versions 1.0.1 through 2.29.1 Description A path traversal vulnerability impacts npm server users of Moment.js, especially if a user-provided locale string is directly used to switch moment locale. This issue allows an unauthenticate...
CVE-2022-24785
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm server users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This...
Cross site scripting
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmurspid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...
CVE-2022-0621
The CVE-2022-0621 case concerns the WordPress dTabs plugin (versions ≤ 1.4). The vulnerability arises because the tab parameter is not sanitized/escaped before being echoed in an admin page, causing a Reflected Cross-Site Scripting (XSS) condition. Affected component: dTabs plugin’s admin output ...
CVE-2022-1002 HTML Injection while inviting Guests
Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations...
Braintree sanitize-url cross-site scripting vulnerability
Braintree sanitize-url is an open source URL cleanup from Braintree, Inc. A cross-site scripting vulnerability exists in versions prior to Braintree sanitize-url 6.0.0, which stems from a lack of user-supplied data and output data validation filtering in the sanitizeUrl function. An attacker coul...
Cross-site Scripting (XSS)
@braintree/sanitize-url is vulnerable to cross-site scripting. The vulnerability exists due to a lack of validating HTML encoding...
Cross-site Scripting in sanitize-url
The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting XSS due to improper sanitization in the sanitizeUrl function...
GHSA-HQQ7-2Q2V-82XQ Cross-site Scripting in sanitize-url
The package @braintree/sanitize-url before 6.0.0 is vulnerable to Cross-site Scripting XSS due to improper sanitization in the sanitizeUrl function...
DEBIAN-CVE-2021-23648
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting XSS due to improper sanitization in sanitizeUrl function...
CVE-2021-23648
The package @braintree/sanitize-url before 6.0.0 are vulnerable to Cross-site Scripting XSS due to improper sanitization in sanitizeUrl function...