Head Start Cross-Site Scripting Vulnerability

Head Start is a web-based knowledge mapping software open-sourced by Open Knowledge Maps. Designed to give researchers a head start on literature reviews hence the name. A security vulnerability exists in Open Knowledge Maps Head Start, Visual Project Explorer version 1.0. An attacker exploited t...

CVE-2023-40618

CVE-2023-40618 is a reflected XSS affecting OpenKnowledgeMaps Head Start (versions 4–7) and Visual Project Explorer 1.0. The vulnerability arises from handling of the ‘service’ parameter in the headstart_snapshot.php endpoint, allowing remote attackers to inject JavaScript into a user session. Do...

CVE-2023-40618

A reflected cross-site scripting XSS vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer 1.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'service' parameter in...

CVE-2021-32751

A flaw was found in Gradle, which allows a remote, authenticated attacker to execute arbitrary code on the system caused by a flaw in start and gradlew. By sending specially crafted environment variables, an attacker can execute arbitrary code on the system. Mitigation CI/CD systems using the...

CVE-2023-40617

A reflected cross-site scripting XSS vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'file' parameter in 'displayPDF.php'...

CVE-2023-40617

CVE-2023-40617 affects OpenKnowledgeMaps Head Start 7. The vulnerability is a reflected cross-site scripting (XSS) in which an attacker can cause a user’s browser to execute arbitrary JavaScript by injecting a malicious payload into the file parameter of the displayPDF.php endpoint. Impact is lim...

Open Knowledge Maps Head Start 7 Cross-Site Scripting Vulnerability

Head Start is a web-based knowledge mapping software open-sourced by Open Knowledge Maps. It is designed to give researchers a head start on literature reviews hence the name. A security vulnerability exists in Open Knowledge Maps Head Start version 7, which stems from the presence of a Reflectiv...

CVE-2023-40617

A reflected cross-site scripting XSS vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'file' parameter in 'displayPDF.php'...

Apache Airflow 安全漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow versions prior to 2.7.1 have an authorization issue vulnerability th...

PT-2023-8623 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions before 2.7.1 Description: The issue allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start...

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the...

bonding on behalf of a new delegator sets the start round to the current round + 1, but the assumed future round may never actually start if rounds get stuck

Lines of code Vulnerability details Impact • If rounds get stuck and currentRound + 1 never happens, the new delegator will never be able to claim earnings. Their startRound will be set to a future round that doesn't exist. • This prevents them from claiming earnings accrued from their staked...

CVE-2023-4471

The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2023-4471 Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scripting

The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

SUSE CVE-2023-39615

Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement function at /libxml2/SAX2.c. This vulnerability allows attackers to cause a Denial of Service DoS via supplying a crafted XML file. NOTE: the vendor's position is that the product does not support...

WordPress plugin Order Tracking Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

FSLogix | Blank Desktop icons and start menu icons are being displayed

When launching published desktops using FSLogix profiles, we observe that the desktop icons are displayed with a blank icon. When trying to open start menu within the published desktop session, we observe blank icons for the start menu tiles...

CVE-2023-41561

Tenda AC9 V3.0 V15.03.06.42multi and Tenda AC5 USAC5V1.0RTLV15.03.06.28 were discovered to contain a stack overflow via parameter startIp and endIp at url /goform/SetPptpServerCfg...

SUSE CVE-2020-22217

Buffer overflow vulnerability in c-ares before 1161 thru 1170 via function aresparsesoareply in aresparsesoareply.c...

Tenda AC8 /goform/openSchedWifi Stack Overflow Code Execution Vulnerability

Tenda AC8 is a dual-band Gigabit wireless router from Tenda, designed for fiber optic homes up to 1000 megabytes, supporting dual-band concurrent transmission rates up to 1167Mbps, and equipped with full Gigabit ports 1 WAN port + 3 LAN ports to meet the needs of 100-1000 megabytes broadband...