3346 matches found
Cross site scripting
SAP NetWeaver Enterprise Portal KMC - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the...
ASB-A-238379819
a function called 'nlaparse', do not check the len of para, it will check nlatype which can be controlled by userspace with 'maxtype' in this case, it is GSCANMAX, then it access polciy array 'policytype', which OOB access happens...
CVE-2022-2824
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
CVE-2022-2824 Authorization Bypass Through User-Controlled Key in openemr/openemr
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
PT-2022-18902 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.1 Description: The issue is related to improper access control, specifically an authorization bypass through a user-controlled key. This allows unauthorized access to certain resources. Recommendations: For...
CVE-2022-2730
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
Authorization
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
CVE-2022-2730 Authorization Bypass Through User-Controlled Key in openemr/openemr
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
CVE-2022-2730 Authorization Bypass Through User-Controlled Key in openemr/openemr
Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.1...
PT-2022-18367 · Openemr · Openemr
Name of the Vulnerable Software and Affected Versions: openemr versions prior to 7.0.0.1 Description: The issue is related to an authorization bypass through a user-controlled key in the GitHub repository openemr/openemr. Recommendations: For versions prior to 7.0.0.1, update to version 7.0.0.1 o...
GHSA-PC62-CQ5X-3J5G node-import `params` argument can be controlled by users without any sanitization
This affects all versions of package node-import. The params argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file index.js...
CVE-2020-7677
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization...
CVE-2020-7677
This affects the package thenify before 3.3.1. The name argument provided to the package can be controlled by users without any sanitization, and this is provided to the eval function without any sanitization...
CVE-2020-7678 Arbitrary Code Execution
This affects all versions of package node-import. The "params" argument of module function can be controlled by users without any sanitization.b. This is then provided to the “eval” function located in line 79 in the index file "index.js"...
thenify 安全漏洞
thenify is an open source callback-based function from Thenables that uses . A security vulnerability exists in versions prior to thenify 3.3.1 , which stems from the vulnerability of this package to arbitrary code execution , the name parameter provided to the package can be controlled by the us...
node-import 安全漏洞
node-import is used by Nanang Mahdaen El Agung Individual Developer Indonesia to import dependencies and run them directly or link them and export to a file. A security vulnerability exists in node-import, which stems from the vulnerability of this package to arbitrary code execution, where the...
CVE-2022-20238
'remappfnrange' here may map out of size kernel memory for example, may map the kernel area, and because the 'vma-vmpageprot' can also be controlled by userspace, so userspace may map the kernel area to be writable, which is easy to be exploitedProduct: AndroidVersions: Android SoCAndroid ID:...
多款Schneider Electric产品安全漏洞
The Schneider Electric OPC UA Modicon Communication Module and the Schneider Electric X80 advanced RTU Communication Module are both products of the French company Schneider Electric. The Schneider Electric OPC UA Modicon Communication Module is an Ethernet communication module with an embedded O...
Cross site scripting
SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. This attack can be used to non-permanently deface or modify portal content. The execution of script content by a...
