Symfony Directory Traversal

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read methods of these classes use a path and a locale to determine the...

SimpleSAMLphp Authentication context bypass in the multiauth module

The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php via vectors related to improper validation of user input...

SimpleSAMLphp allows timing side-channel attacks

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

Adobe ColdFusion 2018.x < 2018 Update 14 / 2021.x < 2021 Update 4 XSS (APSB22-22)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2018.x update 14 or 2021.x update 4. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote...

Xxe

XML External Entity XXE injection vulnerabilities occur when poorly configured XML parsers process user supplied input without sufficient validation. Attackers can exploit this vulnerability to manipulate XML content and inject malicious external entity references...

AVEVA InTouch Command Injection Vulnerability

AVEVA InTouch is an open and extensible HMI from AVEVA UK with intuitive graphical animation and scripting capabilities that provide incredible functionality and flexibility for application designers. A command injection vulnerability exists in AVEVA InTouch. The vulnerability stems from a failur...

USN-5259-3 cron regression

USN-5259-1 and USN-5259-2 fixed vulnerabilities in Cron. Unfortunately that update was incomplete and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the postinst maintainer script in Cron unsafely...

CVE-2022-30278

A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub'...

CVE-2022-1567 WP JS <= 2.0.6 - Reflected Cross-Site Scripting

The WP-JS plugin for WordPress contains a script called wp-js.php with the function wpjsadmin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6...

CVE-2022-24290

The CVE-2022-24290 entry concerns Siemens Teamcenter tcserver.exe with a stack overflow during parsing of user input. Affected are Teamcenter versions prior to: v12.4.0.13, v13.0.0.9, v13.2.0.8, v13.3.0.3, and v14.0.0.2; additionally v13.1 is listed as all versions. The root cause is a stack-base...

WordPress plugin WP-JS 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Bludit CMS Cross-Site Scripting Vulnerability

Bludit CMS is an open source lightweight blog content management system CMS. v3.13.1 of Bludit CMS contains a cross-site scripting vulnerability that originates from the lack of filtering and validation of user input data on the /admin/new-content page. An attacker could use this vulnerability to...

Contao Cross-Site Scripting Vulnerability (CNVD-2022-36995)

Contao is an open source content management system CMS developed using PHP. A cross-site scripting vulnerability exists in versions of Contao prior to 4.13.3, which stems from the application's lack of validation of user input. An attacker could exploit this vulnerability to execute malicious...

Cyclos 4 PRO Cross-Site Scripting Vulnerability (CNVD-2022-77956)

Cyclos 4 PRO is a web server. a cross-site scripting vulnerability exists in Cyclos 4 PRO version 4.14.7 and earlier, which stems from a failure to validate user input during error notification. A remote, unauthenticated attacker could execute javascript code via undefine enumeration constants...

Reflected Cross-Site Scripting (XSS)

microweber/microweber is vulnerable to cross-site scriptingXSS attacks. The library does not properly escape the user input, allowing an attacker to inject and execute malicious javascript when victims visit the page...

Remote Code Execution

pythonlibnmap is vulnerable to remote code execution. An attacker is able to inject arbitrary arguments through the final nmap command line and execute on the underlying operating system when the client application fails to validate the user input resulting in remote command execution vulnerabili...

Cross-site Scripting (XSS)

materialize-css is vulnerable to cross-site scripting. The highlight function of autocomplete.js does not properly escape the user input such as , allowing an attacker to inject and execute malicious javascript...

Image Field Caption - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-036

Image Field Caption imagefieldcaption adds an extra text area for captions on image fields. The module doesn't sanitize user input in certain cases, which leads to a Cross-Site-Scripting XSS vulnerability. The vulnerability is mitigated by several permissions, of which at least some are commonly...

CVE-2022-20084

In telephony, there is a possible way to disable receiving emergency broadcasts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06498874; Issue ID:...

CVE-2022-20627

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. These vulnerabilities are due to insufficient validation of...