71 matches found
cve-2020-11023-demonstration
Jquery XSS - CVE-2020-11023 これは CVE-2020-11023 の再現デモです。ソースは主にこのブログ記事から取得しています。 再現方法 npm install で npm 依存関係をインストールします。jQuery 3.4.1 が依存関係として含まれています。例えば VS Code 用の Live Server などでプロジェクトを実行してください。 サイトには、入力内容を div にコピーする2つの例があります。最初の div では値がそのままコピーされ、2番目の div では jQuery の .html 関数を使用してコンテンツを設定しています。...
cryptovenom
CryptoVenom CryptoVenom: The Cryptography Swiss Army knife What is CryptoVenom? CryptoVenom is an OpenSource tool which contains a lot of cryptosystems and cryptoanalysis methods all in one, including classical algorithms, hash algorithms, encoding algorithms, logic gates, mathematical functions,...
GHSA-JP53-MHQP-8XCG vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-49473 @cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation
@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issu...
CVE-2026-49473
The CVE concerns @cedar-policy/authorization-for-expressjs, an Express middleware that applies Cedar authorization by mapping HTTP requests to Cedar actions. A concrete flaw in versions up to 0.2.x is that the middleware uses req.originalUrl (which includes the query string) to identify Cedar act...
PYSEC-2026-1309 Docassemble unauthorized access through URL manipulation
Impact The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. Patches The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched...
CVE-2026-10233
Assimp contains a local out-of-bounds read in HL1MDLLoader::read_sequence_infos (HL1MDLLoader.cpp) of the Half-Life 1 MDL Loader. The bug is triggered by manipulating the aiString and affects Assimp up to 6.0.4. A local attacker could exploit this; a public exploit is disclosed in sources. No rem...
CVE-2026-9496
Versions of the package pacote from 11.2.7 and before 21.5.1 are vulnerable to Denial of Service DoS via the addGitSha function. An attacker can exploit this vulnerability by supplying a specially crafted spec.rawSpec value that triggers the function’s regex replacement and string-manipulation...
Malicious Package
Overview string-manipulation-typescript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...
MAL-2026-3827 Malicious code in string-manipulation-typescript (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bed3d44d42fd732fc0b3ec3b59c8c75fea479f97b78de4982c5b75bafd9af25 The package string-manipulation-typescript was found to contain malicious code. Source: ghsa-malware...
Malicious code in string-manipulation-typescript (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bed3d44d42fd732fc0b3ec3b59c8c75fea479f97b78de4982c5b75bafd9af25 The package string-manipulation-typescript was found to contain malicious code. Source: ghsa-malware...
[SECURITY] Fedora 44 Update: kf6-kcodecs-6.25.0-1.fc44
KDE Frameworks 6 Tier 1 addon with string manipulation methods...
CVE-2026-23643
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1...
CVE-2026-23643
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1...
CVE-2026-23643
CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1...
Improper Validation of Unsafe Equivalence in Input
Overview alt-design/alt-redirect is an Alt Redirect addon, add Redirects to your site Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input via handling of query string parameters when the "Query String Strip" feature is enabled. An attacker can...
EUVD-2015-4554
Malware in sbrugna...
EUVD-1999-0146
Malware in sbrugna...