CVE-2022-4092

An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input...

Centreon SQL注入漏洞

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for resources such as networks, systems, and applications. A security vulnerability exists in Centreon due to a failure to properly validate...

CVE-2022-25894

All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution RCE in the ExpressionContextImpl class via jexl.createExpressionexpression.evaluatecontext; functionality, due to improper user input validation...

PT-2023-12830 · Bstek · Uflo-Core

Name of the Vulnerable Software and Affected Versions: com.bstek.uflo:uflo-core affected versions not specified Description: The issue concerns improper user input validation in the ExpressionContextImpl class, specifically via the jexl.createExpressionexpression.evaluatecontext functionality,...

CVE-2023-24494

Tenable.sc versions prior to 6.0.0 are affected by a stored XSS vulnerability (CVE-2023-24494) due to improper validation of user-supplied input. An authenticated attacker can entice a user to click a crafted URL, causing script execution in the user’s browser session. The issue is rooted in inpu...

PT-2023-19639 · Tenable · Tenable.Sc

Name of the Vulnerable Software and Affected Versions: Tenable.sc affected versions not specified Description: A formula injection issue exists due to improper validation of user-supplied input. An authenticated attacker could leverage the reporting system to export reports containing formulas,...

CVE-2023-24493

A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a...

sinatra: Reflected File Download attack

A flaw was found in Sinatra, a domain-specific language for creating web applications in Ruby. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input...

sinatra: Reflected File Download attack

A flaw was found in Sinatra, a domain-specific language for creating web applications in Ruby. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input...

CVE-2022-25908

All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...

CVE-2022-25908

CVE-2022-25908 affects the Node.js module create-choo-electron, with all versions vulnerable to Command Injection via the devInstall function due to improper input validation. Connected IBM advisories tie this to IBM Storage Ceph and IBM Maximo MAS deployments, describing feasible command executi...

Cross-site Scripting (XSS)

phpmyfaq is vulnerable to Cross-Site ScriptingXSS attacks. The library does not properly escape the user input before converting to HTML entities, which allows an attacker to inject and execute malicious code on the target system...

PT-2023-12833 · Unknown · Create-Choo-Electron

Name of the Vulnerable Software and Affected Versions: create-choo-electron versions all Description: The issue arises from improper user-input sanitization, making all versions of the package susceptible to Command Injection via the devInstall function. Recommendations: For all versions, conside...

CVE-2022-4092

Removed by vendor...

CVE-2022-4092

An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input...

Spectra < 1.15.0 - Contributor+ Stored Cross-Side Scripting

The plugin does not sanitize user input as it reaches its style HTML attribute, allowing contributors to conduct stored XSS attacks via the plugin's Gutenberg blocks. PoC Note: The exploit requires the Contact Form 7 plugin. Exploit Additional CSS classes for “Contact Form 7 Styler” Gutenberg...

CVE-2023-23950

User’s supplied input usually a CRLF sequence can be used to split a returning response into two responses...

CVE-2022-4092

GitLab EE is affected in versions 15.6 up to 15.6.0, where improper neutralisation of user-supplied input could allow creation of a malicious README page. The issue stems from a vulnerability in README content handling and could impact confidentiality, integrity, and availability as described in ...

CVE-2022-4323

The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...

CVE-2022-3425

The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present...