GHSA-W55J-F7VX-6Q37 Openshift Enterprise source-to-image vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip)

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command. Specific Go Packages...

Openshift Enterprise source-to-image vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip)

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command. Specific Go Packages...

CVE-2022-4489

The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

Design/Logic Flaw

The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

create-choo-app3 is vulnerable to Command Injection via the devInstall function

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

GHSA-RJ7M-2P3G-FJXG create-choo-app3 is vulnerable to Command Injection via the devInstall function

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

Cross-site Scripting (XSS)

eta is vulnerable to Cross-site Scripting XSS. The vulnerability exists in file-handlers.ts due to improper user-input sanitization from the Express API allowing an attacker to inject and execute malicious JavaScript...

Cross-Site Scripting (XSS)

mos/cimage is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the user input before it output to the front end, allowing an attacker to inject and execute malicious JavaScript on victim's browser via the argument $SERVER'SERVERSOFTWARE' in the file...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

Command injection

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25855

The CVE-2022-25855 entry concerns the npm package create-choo-app3, with a documented Command Injection vulnerability in the devInstall function due to improper user-input sanitization. Multiple connected sources (Red Hat, GHSA, OSV, CNVD, SNYK, CVE lists) confirm the issue affects all versions a...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25855

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

Directory Traversal

jszip is vulnerable to Directory Traversal. The vulnerability exists as untrusted user input is not properly validated and/or sanitized, allowing an attacker to exploit the vulnerability via a crafted ZIP archive...

Apache HTTP Server CLRF Injection Vulnerability

Apache HTTP Server is the United States Apache Apache Foundation of an open source web server . The server is fast, reliable and can be expanded through a simple API. A CLRF injection vulnerability exists in Apache HTTP Server versions prior to 2.4.55. The vulnerability stems from a Web applicati...

PT-2023-17489 · Vcu · Vcu

Name of the Vulnerable Software and Affected Versions: vcu affected versions not specified Description: The issue is related to a possible memory corruption due to improper locking in vcu. This could lead to local escalation of privilege, with System execution privileges needed. User interaction ...

Deserialization Of Untrusted Data

manager-pojo is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists because the filterSensitive function of MySQLSinkDTO.java does not properly decode the user input MySQL JDBC URLs, allowing an attacker to control the current state or the flow of the execution...

Possible Reentrance & Unexpected Behaviour Vulnerabilities

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. No protection against reentrancy attacks, for example, the pay function called in the mintCallback function does not check for reentrancy before performing an external call. No checking of return values...

jSuites subect to Cross-site Scripting

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the Editor function...

CVE-2022-25979

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the Editor function...