Cross-site Scripting (XSS)

Overview bootstrap-select is a .NET bundle for bootstrap-select jQuery plugin. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the use of the data-subtext attribute, in cases where that content originates from a user-controlled input. PoC by Snyk Research js HTML ...

Path Traversal

Overview All versions of socket.io-file are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The socket.io-file::createFile message contains a name option that is passed directly to path.join. It is possible to upload files to...

CVE-2020-12256

rConfig 3.9.4 is vulnerable to reflected XSS. The devicemgmnt.php file improperly validates user input. An attacker can exploit this by crafting arbitrary JavaScript in the deviceId GET parameter to devicemgmnt.php...

CVE-2020-12259

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...

Cross site scripting

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...

CVE-2020-12259

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...

WordPress 4.8.x < 4.8.13 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

WordPress 5.1.x < 5.1.5 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

WordPress 5.2.x < 5.2.6 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when untrusted user input is written to the cache store using the raw: true parameter, re-reading the result from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerabl...

WordPress 4.3.x < 4.3.23 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

WordPress 4.0.x < 4.0.30 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

Possible Strong Parameters Bypass in ActionPack

There is a strong parameters bypass vector in ActionPack. Versions Affected: rails = 5.2.4.3, rails = 6.0.3.1 Impact ------ In some cases user supplied information can be inadvertently leaked from Strong Parameters. Specifically the return value of each, or eachvalue, or eachpair will return the...

WordPress 4.2.x < 4.2.27 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

WordPress 3.8.x < 3.8.33 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

WordPress 4.1.x < 4.1.30 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

CVE-2020-7809

ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...

Cross site scripting

ALSong 3.46 and earlier version contain a Document Object Model DOM based cross-site scripting vulnerability caused by improper validation of user input. A remote attacker could exploit this vulnerability by tricking the victim to open ALSong Albumsab file...

HTTP Host Header Injection

A host header injection is inserting both the carriage return and linefeed characters into user input to trick the server. Successful exploitation could allow attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks...

Cisco UCS Director Directory Traversal (CVE-2020-3250)

A directory traversal vulnerability exists in Cisco UCS Director. The vulnerability is due to insufficient validation of user input within the processing of the userAPIDownloadFile API...