CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js

Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...

nodejs: Prototype pollution via console.table properties

Due to the formatting logic of the "console.table" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "proto". The prototype pollution has...

IBM Jazz Team Server HTML注入漏洞

IBM Jazz Team Server is an application server from IBM Corporation. provides base services that enable a group of tools to work together as a single logical server and includes any number of Jazz Team Server Extensions that provide tool-specific functionality.An HTML injection vulnerability exist...

PT-2022-20533 · Mermaid +1 · Mermaid +1

Name of the Vulnerable Software and Affected Versions: Mermaid versions prior to 9.1.3 Description: Mermaid is a JavaScript-based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker can inject arbitrary CSS...

ROS-20220628-02

A vulnerability in the Bluetooth protocol stack for Linux BlueZ is related to insufficient validation of user input during A2DP profile processing. user input during A2DP profile processing. Exploitation of the vulnerability could allow an attacker, remotely, transmit specially crafted data to th...

Authentication flaw

Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters...

CVE-2022-2140 Elcomplus SmartICS Cross-site Scripting

Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters...

Cross-site Scripting (XSS)

parse-url is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of the user input allowing attacker to inject maliciously crafted script into the system...

OneBlog entryUrls parameter server-side request forgery vulnerability

OneBlog is a Java blog. version v2.3.4 of OneBlog contains a server-side request forgery vulnerability in which the source parameter entryUrls fails to properly validate user input and can be exploited to probe the server's intranet resources...

Library Management System With QR Code 1.0 SQL Injection Vulnerability

Title: Library Management System with QR code Attendance 1.0 SQL Injection Author: Ashish Kumar https://www.linkedin.com/in/ashish-kumar-0b65a3184 Vendor: https://www.sourcecodester.com/users/kingbhob02 Software:...

OneBlog Logo Parameter Server-Side Request Forgery Vulnerability

OneBlog is a beautiful and powerful Java blog. OneBlog v2.3.4 version exists server-side request forgery vulnerability, the vulnerability stems from the Link module under the Logo parameter fails to correctly validate the user input, an attacker can use the vulnerability to probe the server...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS, which originates from a lack of data validation filtering of user-supplied data and output in...

CVE-2022-34305

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability...

CVE-2022-23057

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

Cross site scripting

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23057 ERPNext - Stored XSS in My Profile

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23057 ERPNext - Stored XSS in My Profile

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

Command Injection

next-auth is vulnerable to command injection. The vulnerability exists in the assertConfig in assert.ts due to improper handling of user input which allows malicious attacker to inject and execute arbitrary commands...