Input validation

Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-base...

CVE-2024-28111 CSV Injection in exported history CSV files

Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-base...

BIT-GITLAB-2020-13319

An issue has been discovered in GitLab affecting versions prior to 13.1.2, 13.0.8 and 12.10.13. Missing permission check for adding time spent on an issue...

BIT-GITLAB-2020-13336

An issue has been discovered in GitLab affecting versions from 11.8 before 12.10.13. GitLab was vulnerable to a stored XSS by in the error tracking feature...

BIT-GITLAB-2022-2244

An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature...

BIT-GITLAB-2022-3060

Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests...

BIT-MEDIAWIKI-2021-31553

An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the culog database table such that denial of service occurred for certain CheckUser extension pages and functionality. For example, the attacker could...

BIT-PHP-2020-7062 Null Pointer Dereference in PHP Session Upload Progress

In PHP versions 7.2.x below 7.2.28, 7.3.x below 7.3.15 and 7.4.x below 7.4.3, when using file upload functionality, if upload progress tracking is enabled, but session.uploadprogress.cleanup is set to 0 disabled, and the file upload fails, the upload procedure would try to clean up data that does...

CVE-2024-24098

Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed...

CVE-2024-24098

Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed...

Sql injection

Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed...

CVE-2024-24098

Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed...

CVE-2024-24098

CVE-2024-24098 affects Code-projects Scholars Tracking System 1.0. The News Feed is vulnerable to SQL Injection due to lack of input validation, enabling potential unauthorized SQL execution. Connected advisories consistently identify the issue as a News Feed SQL injection vulnerability; exploita...

Scholars Tracking System SQL注入漏洞

Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. Scholars Tracking System version 1.0 suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an...

openSUSE: Security Advisory for webkit2gtk3 (SUSE-SU-2023:3233-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for webkit2gtk3 (SUSE-SU-2023:3419-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-0378

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This...

Cross site scripting

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This...

CVE-2024-0378

CVE-2024-0378 affects the AI Engine plugin for WordPress, specifically versions up to and including 2.2.0. The issue is stored XSS caused by insufficient input sanitization and output escaping in the AI chat data when discussion tracking is enabled. Impact: unauthenticated attackers can inject sc...

CVE-2024-0378 AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This...