14338 matches found
Remote Code Execution (RCE)
dtale is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling or validation of user input in the "Custom Filter" feature using the getstrarg method, allowing malicious code to be executed on the server...
CVE-2024-21529
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the...
CVE-2024-21529
Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the...
Ivanti Endpoint Manager updateAssetInfo SQL Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the updateAssetInfo method. The issue results from the lack of...
send vulnerable to template injection that can lead to XSS
Impact passing untrusted user input - even after sanitizing it - to SendStream.redirect may execute untrusted code Patches this issue is patched in send 0.19.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...
GHSA-CM22-4G7W-348P serve-static vulnerable to template injection that can lead to XSS
Impact passing untrusted user input - even after sanitizing it - to redirect may execute untrusted code Patches this issue is patched in serve-static 1.16.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...
GHSA-QW6H-VGH9-J6WX express vulnerable to XSS via response.redirect()
Impact In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect may execute untrusted code Patches this issue is patched in express 4.20.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issu...
CVE-2024-43800
A flaw was found in serve-static. This issue may allow the execution of untrusted code via passing sanitized yet untrusted user input to redirect. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria...
CVE-2024-43796
A flaw was found in Express. This vulnerability allows untrusted code execution via passing untrusted user input to response.redirect, even if the input is sanitized. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...
CVE-2024-43800
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
CVE-2024-43800
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
CVE-2024-43800 serve-static affected by template injection that can lead to XSS
serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect may execute untrusted code. This issue is patched in serve-static 1.16.0...
CVE-2024-43799
Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect which executes untrusted code. This issue is patched in send 0.19.0...
CVE-2024-43796
CVE-2024-43796 : Express.js (Node) vulnerable in versions prior to 4.20.0 where untrusted input passed to response.redirect() can lead to execution of untrusted code. This is mitigated by upgrading to Express.js 4.20.0 or newer; the issue is categorized under a cross-site scripting concern in the...
CVE-2024-43796
Express.js minimalist web framework for node. In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect may execute untrusted code. This issue is patched in express 4.20.0...
node-gettext vulnerable to Prototype Pollution
All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations function in gettext.js due to improper user input sanitization...
CVE-2024-44120
SAP NetWeaver Enterprise Portal is vulnerable to reflected cross site scripting due to insufficient encoding of user-controlled input. An unauthenticated attacker could craft a malicious URL and trick a user to click it. If the victim clicks on this crafted URL before it times out, then the...
Craft CMS vulnerable to stored XSS in breadcrumb list and title fields
Summary Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input. Details 1. In the /admin/categories page, category title isn't sanitized and triggered xss. 2. In the category edit page under the /admin/categories/, category title in breadcrumb list isn't...