Command Injection in forsigner/node-pngdefry

Overview Affected versions execute arbitrary commands remotely inside the victim's PC. The issue occurs because user input is formatted inside a command that will be executed without any checks...

CVE-2020-7646

curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input...

CVE-2020-7646

curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input...

CVE-2020-7646

curlrequest through 1.0.1 allows reading any file by populating the file parameter with user input...

CVE-2020-3313

A vulnerability in the web UI of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to insufficient validatio...

Cross site scripting

A vulnerability in the web UI of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to insufficient validatio...

Crlf injection

A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to perform a carriage return line feed CRLF injection attack against a user of an affected service. The vulnerability is due to insufficient validation of user input. An attacker could exploit this...

CVE-2020-3313 Cisco Firepower Management Center Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco Firepower Management Center FMC Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the FMC Software. The vulnerability is due to insufficient validatio...

Local File Inclusion

Teampass is vulnerable to local file inclusion. It does not sanitize the newValue HTTP request provided by the user along with sources/users.queries.php to choose language preferences, allowing a user to include malicious PHP file and to execute directly on the server...

Cross-site Scripting (XSS)

github.com/open-policy-agent/opa is vulnerable to cross-site scriptingXSS attacks. The library does not properly escape user input string parameters before being included in the rendered index.html page, allowing a malicious user to inject and execute malicious web script...

Node.js third-party modules: [extra-ffmpeg] Command Injection via insecure command formatting

I would like to report a Command Injection issue in the extra-ffmpeg module. It allows to execute arbitrary commands on the victim's PC. Module module name: extra-ffmpeg version: 4.0.3 npm page: https://www.npmjs.com/package/extra-ffmpeg Module Description Decode, encode, transcode, mux, demux,...

Information Disclosure

Red Hat Satellite's Job Invocation is vulnerable to information disclosure. The User Input entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data...

CVE-2020-11016

IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue...

Design/Logic Flaw

IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue...

Cross-site Scripting (XSS)

typo3/cms-backend is vulnerable to cross-site scripting XSS attacks.The library does not properly encode user input strings before being displayed, allowing a malicious user to inject and execute malicious web script on a user's browser...

Command Injection Vulnerability in Multiple NETGEAR Products (CNVD-2021-46561)

NETGEAR R7500 and others are products of NETGEAR USA.NETGEAR R7500 is a wireless router.NETGEAR D6100 is a wireless modem.NETGEAR R6100 is a wireless router. An injection vulnerability exists in multiple NETGEAR products. The vulnerability arises from a lack of proper validation of user input dat...

OS Command Injection

git-promise is vulnerable to OS commnad injection. User input is not validated and sanitized before being passed to the git function and executed...

Cross-site Scripting (XSS)

forkcms/forkcms is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape user input displayname value in the function loadDataGrid in Index.php allowing a malicious user to inject and execute malicious web script...

GitLab: Stored XSS on PyPi simple API endpoint

Summary The recently released PyPi package feature has a new endpoint at /api/:version/projects/:id/packages/pypi/simple/packagename which exposes an HTML page listing the package versions. The packagelink's are generated using the following code: packagepresenter.rbL50 ruby def packagelinkurl,...

Multiple NETGEAR Product Injection Vulnerabilities (CNVD-2021-59159)

NETGEAR R7000 is a wireless router, NETGEAR D3600 is a wireless modem, and NETGEAR WNDR3700 is a wireless router. An injection vulnerability exists in multiple NETGEAR products. The vulnerability stems from a lack of proper validation of user input data by a network system or product during user...