Cross-site scripting vulnerability in multiple NETGEAR products (CNVD-2020-26945)

NETGEAR D7800 and others are products of NETGEAR, Inc.NETGEAR D7800 is a wireless modem.NETGEAR R7500 is a wireless router.NETGEAR XR500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless router.NETGEAR R7500 is a wireless...

ViewVC Cross-Site Scripting Vulnerability (CNVD-2020-33722)

ViewVC is a Web-based CVS, SVN code repository browsing tool . A cross-site scripting vulnerability exists in ViewVC versions prior to 1.1.28 and 1.2.1. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability...

Command Injection

Overview npm-programmatic is a library that allows you to access npm commands programmatically from javascript. Affected versions of this package are vulnerable to Command Injection. The packages and option properties are concatenated together without any validation and are used by the exec...

WordPress StatTraq SQL Injection Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. WordPress StatTraq suffers from a SQL injection vulnerability that stems from the database...

Micro Focus Service Manager Automation SQL Injection Vulnerability

Micro Focus Service Manager is a suite of service desk software from Micro Focus UK. The software supports the deployment of a comprehensive IT service management ITSM system and standardizes management processes. A SQL injection vulnerability exists in Micro Focus SMA. The vulnerability stems fr...

PrestaShop ps_facetedsearch cross-site scripting vulnerability

PrestaShop is a set of open source e-commerce solutions from PrestaShop, USA. The solution provides a variety of payment methods, short message alerts and product image zoom and other features. psfacetedsearch is one of the add layered navigation filter module. A cross-site scripting vulnerabilit...

CVE-2020-10886

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service, which listens on TCP port...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2020-18399)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A SQL injection vulnerability exists in Dolibarr ERP/CRM...

CVE-2020-10544

An XSS issue was discovered in tooltip/tooltip.js in PrimeTek PrimeFaces 7.0.11. In a web application using PrimeFaces, an attacker can provide JavaScript code in an input field whose data is later used as a tooltip title without any input validation...

Arbitrary Code Execution

Overview fun-map is a functional utilities for pretending that JS objects are Clojure string maps. Affected versions of this package are vulnerable to Arbitrary Code Execution. The injection point is located in line 26 in the index file class.js; the members argument of the create function can be...

Command Injection

Overview push-dir is a package to push the contents of a directory to a remote branch. Affected versions of this package are vulnerable to Command Injection. Arguments provided as part of the variable opt.branch is not validated before being provided to the git command within index.jsL139. This...

Hitron Technologies CODA-4582U Cross-Site Scripting Vulnerability

Hitron Technologies CODA-4582U is a modem from Hitron Technologies, Taiwan, China. A cross-site scripting vulnerability exists in Hitron CODA-4582U version 7.1.1.30. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the...

CHIYU BF430 TCP IP Converter Cross-Site Scripting Vulnerability

CHIYU BF-430 is a networking server that provides communication for access control, time and attendance system and other devices from CHIYU Technology CHIYU in Taiwan, China. A cross-site scripting vulnerability exists in CHIYU BF-430 232/485 TCP/IP Converter versions prior to 1.16.00. The...

TestLink SQL Injection Vulnerability

TestLink is a set of open source software for managing the software testing process and providing statistical analysis. A SQL injection vulnerability exists in TestLink version 1.9.19. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...

bootstrap: XSS in the tooltip data-viewport attribute

A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the tooltip data-viewport attribute. This flaw allows a remote attacker to execute a script in a victim's Web browser within the security context of the hosting W...

Online TV Database SQL Injection Vulnerability

Online TV Database is a set of online TV program database. A SQL injection vulnerability exists in the 'ID' parameter in Online TV Database version 2011. The vulnerability stems from a database-based application that lacks validation of externally entered SQL statements. An attacker can exploit...

PT-2021-6711 · FFmpeg +3 · Ffmpeg +3

Name of the Vulnerable Software and Affected Versions: Ffmpeg version 4.2.1 Description: The issue is related to a Buffer Overflow in the config input function within the libavfilter/vf gblur.c component of the Ffmpeg library. This allows attackers to potentially cause a Denial of Service or...

Dairy Farm Shop Management System SQL Injection Vulnerability

Dairy Farm Shop Management System is a PHP and MySQL based dairy farm management system . A SQL injection vulnerability exists in Dairy Farm Shop Management System version 1.0. The vulnerability stems from a lack of validation of externally entered SQL statements in a database-based application. ...

TYPO3 SQL Injection Vulnerability (CNVD-2019-47027)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A SQL injection vulnerability exists in Typo3 versions 4.5.0 through 4.5.5. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...

DEBIAN-CVE-2019-18888

An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command...