4291 matches found
CVE-2019-12366
The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...
CVE-2019-12370
The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...
CVE-2019-12367: Improper Neutralization of Input During Web Page Generation
The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...
PT-2020-9307
Name of the Vulnerable Software and Affected Versions Spark application versions 2.0.2 and earlier Description The issue allows for cross-site scripting XSS via an event attribute and arbitrary file loading via a src attribute, provided the application has the READ EXTERNAL STORAGE permission...
PT-2020-9306
Name of the Vulnerable Software and Affected Versions TypeApp versions 1.9.5.35 and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For TypeApp versions...
PT-2020-9303
Name of the Vulnerable Software and Affected Versions The Nine application versions 4.5.3a and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For...
CVE-2019-12368: Improper Neutralization of Input During Web Page Generation
The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...
PT-2020-9302
Name of the Vulnerable Software and Affected Versions Newton application versions prior to 10.0.24 Description The issue allows for cross-site scripting XSS via an event attribute and arbitrary file loading via a src attribute. This can occur if the application has the READ EXTERNAL STORAGE...
PT-2020-9305
Name of the Vulnerable Software and Affected Versions Edison Mail versions 1.7.1 and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For Edison Mail...
PT-2020-9304
Name of the Vulnerable Software and Affected Versions BlueMail versions 1.9.5.36 and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For BlueMail versio...
OS Command Injection
pulverizr is vulnerable to OS Command Injection. The vulnerability exists as the value of src is improperly handled by src/command.js...
CVE-2020-7601
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
CVE-2020-7601
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
CVE-2020-7601
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
CVE-2020-7601: Improper Neutralization of Special Elements used in an OS Command
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
Command Injection
Overview gulp-scss-lint is a Lint your .scss files. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands to the exec function located in src/command.js via the provided options. PoC by JHU System Security Lab var root =...
Authentication flaw
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...
CVE-2019-10796
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...
CVE-2019-10796: Improper Neutralization of Special Elements used in an OS Command
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...