8893 matches found
CVE-2023-24812
Misskey (open source, decentralized social media platform) has a SQL injection vulnerability in versions prior to 13.3.3 caused by insufficient parameter validation in the note search API (notes/search-by-tag). The issue is fixed in version 13.3.3. Recommendation: upgrade to 13.3.3 or later. If u...
K10506844: Apache Struts 2 vulnerabilities CVE-2013-1966, CVE-2013-2115, CVE-2013-2134, and CVE-2013-2135
Security Advisory Description CVE-2013-1966 Apache Struts 2 before 2.3.14.1 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag. CVE-2013-2115 Apache Struts 2 before 2.3.14.2 allow...
K16967: XSS vulnerability in jQuery CVE-2011-4969
Security Advisory Description Cross-site scripting XSS vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag. CVE-2011-4969 Impact There is no impact; F5 products are not affected by this...
Malicious Package
Overview remove-docker-tag is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...
Rxss in msg parameter
Affected url Affected parameter : msg It appear that html tags are rendered in the page via msg parameter. So I tried tag and it work, so i tried adding event handlers in this case onpageshow=alertdocument.domainand it trigred xss. POC :...
SUSE CVE-2023-24785
An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature...
CVE-2023-24785
An issue in Giorgio Tani peazip v.9.0.0 allows attackers to cause a denial of service via the End of Archive tag function of the peazip/pea UNPEA feature...
CVE-2023-24785
CVE-2023-24785 affects Giorgio Tani’s PeaZip (peazip) up to at least v9.0.0, where the DoS is triggered through the End of Archive tag function in the peazip/pea UNPEA feature. The connected documents confirm the issue and cite the vulnerability description, with remediation noted in advisories t...
UBUNTU-CVE-2021-23980
A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument stripcomments=False Note: none of the above tags are in the default allowe...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : Go Text vulnerabilities (USN-5873-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5873-1 advisory. It was discovered that Go Text incorrectly handled certain encodings. An attacker could possibly use this issue to cause a denial...
Magecart Attack Disguised as Google Tag Manager
Magecart skimmers constantly evolve. Recent attacks aimed at stealing sensitive customer information illustrate the need for comprehensive security solutions...
SUSE CVE-2003-1418
Apache HTTP Server 1.3.22 through 1.3.27 on OpenBSD allows remote attackers to obtain sensitive information via 1 the ETag header, which reveals the inode number, or 2 multipart MIME boundary, which reveals child process IDs PID...
SUSE CVE-2004-0595
The striptags function in PHP 4.x up to 4.3.7, and 5.x up to 5.0.0RC3, does not filter null \0 characters within tag names when restricting input to allowed tags, which allows dangerous tags to be processed by web browsers such as Internet Explorer and Safari, which ignore null characters and...
SUSE CVE-2004-1187
Heap-based buffer overflow in the pnmgetchunk function for xine 0.99.2, and other packages such as MPlayer that use the same code, allows remote attackers to execute arbitrary code via long PNATAG values, a different vulnerability than CVE-2004-1188...
SUSE CVE-2004-1188
The pnmgetchunk function in xine 0.99.2 and earlier, and other packages such as MPlayer that use the same code, does not properly verify that the chunk size is less than the PREAMBLESIZE, which causes a read operation with a negative length that leads to a buffer overflow via 1 RMFTAG, 2 DATATAG,...
SUSE CVE-2004-1302
The id3tagsort function in id3tag.c for YAMT 0.5 allows remote attackers to execute arbitrary commands via an MP3 file with double quotes in the Artist tag...
SUSE CVE-2004-1613
Mozilla allows remote attackers to cause a denial of service application crash from null dereference or infinite loop via a web page that contains a 1 TEXTAREA, 2 INPUT, 3 FRAMESET or 4 IMG tag followed by a null character and some trailing characters, as demonstrated by mangleme...
SUSE CVE-2004-1617
Lynx, lynx-ssl, and lynx-cur before 2.8.6dev.8 allow remote attackers to cause a denial of service infinite loop via a web page or HTML email that contains invalid HTML including 1 a TEXTAREA tag with a large COLS value and 2 a large tag name in an element that is not terminated, as demonstrated ...
SUSE CVE-2005-0664
Buffer overflow in the EXIF library libexif 0.6.9 does not properly validate the structure of the EXIF tags, which allows remote attackers to cause a denial of service application crash and possibly execute arbitrary code via a JPEG image with a crafted EXIF tag...