989 matches found
CVE-2023-27533
A vulnerability in input validation exists in curl 8.0 during communication using the TELNET protocol may allow an attacker to pass on maliciously crafted user name and "telnet options" during server negotiation. The lack of proper input scrubbing allows an attacker to send content or perform...
Bitbucket Environment Variable Remote Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Bitbucket Environment Variable RCE', 'Description' = %q For various versions of Bitbucket, there is an authenticated command injection...
UBUNTU-CVE-2021-36402
In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk...
SUSE CVE-2010-3860
IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including 1 user.name, 2 user.home, and 3 java.home system properties, and other sensitive...
SUSE CVE-2013-4996
Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 a crafted database name, 2 a crafted user name, 3 a crafted logo URL in the navigation panel, 4 a...
SUSE CVE-2017-7847
Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird 52.5.2...
SUSE CVE-2017-15671
The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27, when invoked with GLOBTILDE, could skip freeing allocated memory when processing the operator with a long user name, potentially leading to a denial of service memory leak...
SUSE CVE-2017-15804
The glob function in glob.c in the GNU C Library aka glibc or libc6 before 2.27 contains a buffer overflow during unescaping of user names with the operator...
SUSE CVE-2018-10995
SchedMD Slurm before 17.02.11 and 17.1x.x before 17.11.7 mishandles user names aka username fields and group ids aka gid fields...
SUSE CVE-2022-24710
Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and language fields. Due to this improper neutralization it is possible to perform cross-site scripting via these fields. The issues were fixed i...
GHSA-Q3C8-65Q7-9V78 Cross site scripting in automad/automad
Cross Site Scripting XSS vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user...
CVE-2021-37502
Cross Site Scripting XSS vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user...
CVE-2021-37502
Cross Site Scripting XSS vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user...
CVE-2021-37502: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user...
CVE-2021-37502
CVE-2021-37502 concerns automad 1.7.5. The vulnerability is a Cross-Site Scripting (XSS) flaw in the user-creation flow, exploitable via the username field when adding a new user. The root cause appears to be insufficient input validation/escaping in accounts.php, allowing injected JavaScript to ...
CVE-2021-43448
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known...
ONLYOFFICE 输入验证错误漏洞
Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A security vulnerability exists in all versions of ONLYOFFICE prior to 2021-11-08 that stems from vulnerability to improper input validation. If the document ID is known, the lack of input validation could allow an...
CVE-2021-43448: Improper Input Validation
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can allow an attacker to spoof the names of users who interact with a document, if the document id is known...
Integer Overflow or Wraparound
Overview publifycore is a Core engine for the Publify blogging system, formerly known as Typo. Affected versions of this package are vulnerable to Integer Overflow or Wraparound in app/models/user.rb, which allows attackers to cause denial of service by supplying an excessively long name value fo...