GitPython: Insecure non-multi options in clone and clone_from is not blocked

An improper input validation vulnerability was found in GitPython. This flaw allows an attacker to inject a maliciously crafted remote URL into the clone command, possibly leading to remote code execution...

Debian: Security Advisory (DLA-3575-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GitPython: Insecure non-multi options in clone and clone_from is not blocked

An improper input validation vulnerability was found in GitPython. This flaw allows an attacker to inject a maliciously crafted remote URL into the clone command, possibly leading to remote code execution...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to inject arbitrary JavaScript via the URL path...

CVE-2023-39109

CVE-2023-39109 : Multiple sources confirm a Server-Side Request Forgery (SSRF) in rConfig v3.9.4, via the path_a parameter in the doDiff function of /classes/compareClass.php. This allows authenticated attackers to cause the server to fetch arbitrary URLs, including potentially internal resources...

Oracle Linux 6 : python (ELSA-2023-3550)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-3550 advisory. - ASCII newline and tab characters are stripped from the URL CVE-2022-0391Orabug: 35479836 Tenable has extracted the preceding description block direct...

CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. For instance, the following URL execute an alter on the browser:...

Progress OpenEdge 注入漏洞

Progress OpenEdge is an application. A security vulnerability exists in Progress OpenEdge LTS versions prior to 11.7.16, 12.x through 12.2.12, and 12.3.x through 12.6.x. The vulnerability stems from a URL injection attack that can be executed by a remote user to change identity or role membership...

CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

PT-2023-24734 · Progress · Openedge

Name of the Vulnerable Software and Affected Versions: OpenEdge versions prior to 12.7 OpenEdge LTS versions prior to 11.7.16 OpenEdge 12.x versions prior to 12.2.12 OpenEdge 12.3.x through 12.6.x Description: A remote user with any OEM or OEE role could perform a URL injection attack to change...

CVE-2023-34203

CVE-2023-34203 affects Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer). A remote user who has any OEM or OEE role can perform a URL injection attack to change identity or role membership, enabling escalation to admin. Affected versions are: OpenEdge LTS before 11.7.16; Ope...

XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

GHSA-X234-MG7Q-M8G8 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alertdocument.domain This vulnerability exists sin...

Server side request forgery (ssrf)

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests v...

CVE-2023-29291 Server Side Request Forgery (SSRF) in USPS carrier integration configuration

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests v...

Cross-site Scripting (XSS)

com.liferay.client.extension.type.impl is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the IFrame-type remote apps in the library because it does not properly escape the URL fields, which allows an attacker to inject and execute malicious JavaScript through the remote app's...

Cross site scripting

Reflected Cross Site Scripting XSS in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly...

Wallpaper 安全漏洞

Wallpaper is a wallpaper application from Wallpaper Inc. A security vulnerability exists in Wallpaper version 12, which stems from a vulnerability that allows an attacker to force the application to load a malicious image URL and display it in the UI by injecting data, ultimately resulting in a...