Template Injection

fieldtest is vulnerable to template injection. Unvalidated input allows an attacker to pass arbitrary variants via query parameters. This can potentially lead to cross-site scripting vulnerabilities or SQL injection...

Arbitrary Variants Via Query Parameters

Due to unvalidated input, an attacker can pass in arbitrary variants via query parameters. If an application treats variants as trusted, this can lead to potential vulnerabilities like SQL injection or cross-site scripting XSS. For instance: landingpage = fieldtest:landingpage Page.where"key =...

CVE-2018-15730

An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x80002067...

ENTTEC Datagate Mk2 Cross-Site Scripting Vulnerability

The ENTTEC Datagate MK2 is a lighting controller from ENTTEC Australia. A cross-site scripting vulnerability exists in the Web Configuration feature in the ENTTEC Datagate Mk2 70044update05032019-482 release. The vulnerability stems from the WEB application lacking proper validation of client dat...

IBM Jazz for Service Management Input Validation Error Vulnerability

IBM Jazz for Service Management is an integrated service management product from IBM that provides visibility into the service management environment. An input validation error vulnerability exists in IBM Jazz for Service Management. The vulnerability originates from a network system or product...

DEBIAN-CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

PYSEC-2019-79

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

UBUNTU-CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

CVE-2019-10048

The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying...

Vtiger CRM SQL Injection Vulnerability (CNVD-2019-16507)

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. A SQL injection vulnerability exists in the...

Intel i915 Graphics Kernel Mode Driver Input Validation Error Vulnerability

Intel i915 Graphics is a set of graphics card drivers from Intel Corporation.Kernel Mode Driver is one of the kernel mode drivers. An input validation error vulnerability exists in the Intel i915 Graphics Kernel Mode Driver. The vulnerability arises from a networked system or product that does no...

CommSy SQL Injection Vulnerability

Commsy is a Web-based, open source community system for project management. A SQL injection vulnerability exists in CommSy version 8.6.5. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerabili...

Microsoft Windows Jet Database Engine Buffer Overflow Vulnerability (CNVD-2019-24832)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Jet Database Engine is one of the database engines. A buffer overflow vulnerabilit...

OpenProject SQL Injection Vulnerability

OpenProject is an open source Web-based project management software . The software has project planning , task management , bug tracking and cost budgeting and other functions . A SQL injection vulnerability exists in OpenProject versions 5.0.0 through 8.3.1. The vulnerability stems from a lack o...

Foxit Studio Photo Remote Code Execution Vulnerability (CNVD-2019-12135)

Foxit Studio Photo is a set of image editing software from the Chinese company Foxit Foxit. A security vulnerability exists in the handling of EZI files in Foxit Studio Photo 3.6.6.779 and prior versions, which arises from the program failing to properly validate user-submitted input. An attacker...

PT-2019-18303 · Xiaomi · Xiaomi Mi6 Browser

Name of the Vulnerable Software and Affected Versions: Xiaomi Mi6 Browser versions prior to 10.4.0 Description: This issue allows remote attackers to execute arbitrary code on vulnerable installations. User interaction is required, where the target must visit a malicious page or open a malicious...

Magento SQL Injection Vulnerability

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engine and payment gateway and other functions. A SQL injection vulnerability exists in Magento, which stems from a lack of validation of externally entered SQL...

GHSA-PMV6-GF98-P3R5 Command Injection in kill-port

Versions of kill-port prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the kill function. This may allow attackers to run arbitrary commands in the system if user input such as the port number is passed directly to the function. Recommendation Upgrad...

Cisco Nexus 9000 Series Switch Matrix Switch Local Command Injection Vulnerability

The Cisco Nexus 9000 Series switches are modular and fixed-port network switches designed for data centers. A Shell Escape vulnerability exists in the software of the Cisco Nexus 9000 Series ACI mode switches. The vulnerability stems from a failure to validate user-supplied input when issuing...

PT-2019-18159 · Delta Industrial Automation · Cncsoft Screeneditor

Name of the Vulnerable Software and Affected Versions: Delta Industrial Automation CNCSoft ScreenEditor versions 1.00.84 and prior Description: An out-of-bounds read issue may cause the software to crash due to lacking user input validation for processing project files. This occurs when the...