Remote Code Execution (RCE)

xalpha is vulnerable to Remote Code Execution RCE. The vulnerability exists in the basicinit function of info.py due to the use of the eval method without user input validation, which allows an attacker to execute malicious code in the system...

Cross-site Scripting (XSS)

decidim is vulnerable to Cross-Site Scripting. The vulnerability is due to a lack of user-input sanitization in external link redirections, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Zyxel ATP 操作系统命令注入漏洞

Zyxel ATP is a firewall from Zyxel. A security vulnerability exists in the Zyxel ATP ZLD versions V5.10 through V5.36, USG FLEX ZLD versions V5.00 through V5.36, USG FLEX 50W / USG20W-VPN ZLD versions V5.10 through V5.36, VPN ZLD versions V5.00 through V5.36, which stems from the inability of the...

Geeklog router.php cross-site scripting vulnerability

Geeklog is free and open source blogging software. A cross-site scripting vulnerability exists in Geeklog router.php due to an incorrect validation of user-supplied input by the publichtml/admin/router.php script. An attacker could exploit the vulnerability to steal the victim's cookie-based...

SUSE CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

CVE-2023-37473

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...

CVE-2023-37473 Limited code execution in zenstruck/collections

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...

CVE-2023-37473 Limited code execution in zenstruck/collections

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...

Regular Expression Denial Of Service (ReDoS)

apacheairflow is vulnerable to Regular expression Denial of Service ReDoS. The vulnerability exists in the partialsubset function at dag.py due to not validating user input regex efficiently which allows an attacker to send a crafted input causing an application crash...

Cross-Site Scripting (XSS)

wintercms/winter and winter/storm are vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape user input, which allows an attacker with backend.managebranding permissions to upload SVGs as the application logo and execute malicious javascript on victim's browser...

PT-2023-25985 · Unknown · Zenstruck/Collections

Name of the Vulnerable Software and Affected Versions: zenstruck/collections versions prior to 0.2.1 Description: The issue arises from passing callable strings, such as system, which causes the function to be executed. This results in a limited subset of specific user input being executed as if ...

CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

UBUNTU-CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

CVE-2023-29456 Inefficient URL schema validation

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

Cross Site Scripting (XSS)

Decidim is vulnerable to Cross Site Scripting XSS vulnerability. The vulnerability is due to not sanitising user input correctly while processing proposals leading to attacker make other users endorse or support proposals they have no intention of supporting or endorsing...

Cross-site Scripting (XSS)

mediawiki/core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the SiteLinksView.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Adobe ColdFusion 代码问题漏洞

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has a deserialization vulnerability that arises from unsafe deserialization of...

WordPress Plugin WP EasyCart SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin WP EasyCar...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the processes filter. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to...