Cross-site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of user input validation in tagschema.go, which allows an attacker to inject and execute malicious Javascript into the browser...

PT-2023-26569 · Npm · Import-In-The-Middle

Name of the Vulnerable Software and Affected Versions: import-in-the-middle versions prior to 1.4.2 Description: The import-in-the-middle loader works by generating a wrapper module on the fly, using the module specifier to load the original module and add some wrapping code. This allows for remo...

Improper Input Validation

chromium is vulnerable to Improper Input Validation. The vulnerability exists due to the lack of user input validation in the QUIC of the library, allowing an attacker to perform header splitting via malicious network traffic...

Open Redirect

gitlab is vulnerable to Open Redirect. The vulnerability exists due to the lack of sanitization in the user input URLs, which allows an attacker to redirect users to malicious locations...

Cross-Site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape user input while adding a new comment, allowing an attacker to inject and execute malicious javascript on victim's browser...

Cross-Site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the user input inserted through sitename parameter before it output to the front end, allowing an attacker to inject and execute malicious javascript on a victim's browser...

Cross-Site Scripting (XSS)

github.com/golang/net is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape user input in text nodes outside the HTML namespace, allowing an attacker to inject and execute malicious JavaScript on a victim's browser...

CVE-2023-20204

A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

Input validation

A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters ATAs could allow an authenticated, remote attacker to to modify a web page in the context of a user's browser. This vulnerability is due to insufficient validation of user-supplied input by the...

Design/Logic Flaw

A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct XSS attacks. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the...

CVE-2023-20218

Cisco SPA500 Series ATAs web-based management interface is affected by CVE-2023-20218. Root cause: insufficient validation of user-supplied input in the web UI. Attack scenario: authenticated remote attacker can persuade a user to click a crafted link, enabling content modification in the browser...

CVE-2023-21410

User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution...

Sql injection

User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections...

CVE-2023-21412 Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier

User provided input is not sanitized on the AXIS License Plate Verifier specific “search.cgi” allowing for SQL injections...

CVE-2023-21411 Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier

User provided input is not sanitized in the “Settings Access Control” configuration interface allowing for arbitrary code execution...

CVE-2023-21411 Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier

User provided input is not sanitized in the “Settings Access Control” configuration interface allowing for arbitrary code execution...

Cross-Site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the user input via the Check function, which allows an attacker to inject and execute malicious javascript on a victim's browser...

Cross-site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the library's lack of user input sanitization, which allows an attacker to inject and execute malicious javascript...

Simple Online Mens Salon Management System Cross-Site Scripting Vulnerability

Simple Online Mens Salon Management System is open source a men's salon management system . Simple Online Mens Salon Management System v1.0 version of a cross-site scripting vulnerability , the vulnerability stems from the file /admin/?page=user/list parameter First Name/Last Name/Username on the...

Code injection

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering...