CVE-2024-20479

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affect...

CVE-2024-20479

The CVE-2024-20479 entry involves Cisco Identity Services Engine (ISE) with a stored XSS vulnerability in the web-based management interface caused by insufficient input validation. Affected component: the web-based management UI; root cause: improper handling of user-supplied input on specific p...

CVE-2024-20479

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affect...

CVE-2024-20443

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affect...

CVE-2024-20443

Cisco ISE CVE-2024-20443 affects the web-based management interface with stored XSS due to insufficient input validation. An authenticated, low-privilege user could inject malicious scripts into specific pages, potentially executing code in the interface context or accessing browser-based informa...

Cross-site Scripting (XSS)

microweber/microweber is vulnerable to Cross Site Scripting XSS. The vulnerability is due to insufficient input validation in the userfiles\modules\tags\addtaggingtagged.php, allows attackers to inject and execute arbitrary JavaScript...

jinja2: accepts keys containing non-attribute characters

A flaw was found in jinja2. The xmlattr filter accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as opposed to only values as user input, and...

CVE-2024-41913

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input...

CVE-2024-41913

Poly Clariti Manager devices (firmware up to 10.10.2.2) are affected by a vulnerability where user input is not properly sanitized, enabling an arbitrary file upload pathway. Several sources associate this with potential remote code execution or arbitrary file upload risk. The issue affects Poly ...

CVE-2024-41913 Clariti Manager – Arbitrary File Upload

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input...

CVE-2024-41913 Clariti Manager – Arbitrary File Upload

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize User input...

CVE-2024-7009

Unsanitized user-input in Calibre = 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database...

CVE-2024-7008

Unsanitized user-input in Calibre = 7.15.0 allow attackers to perform reflected cross-site scripting...

CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)

Unsanitized user-input in Calibre = 7.15.0 allow attackers to perform reflected cross-site scripting...

CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)

Unsanitized user-input in Calibre = 7.15.0 allow attackers to perform reflected cross-site scripting...

CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)

Unsanitized user-input in Calibre = 7.15.0 allow attackers to perform reflected cross-site scripting...

Code Injection

elektra is vulnerable to Code Injection. The vulnerability is due to improper handling of user input in the live search functionality of the Ruby on Rails-based Elektra web application, which allows authenticated users to craft a search term containing Ruby code that flows into an eval call,...

Clariti Manager - Arbitrary File Upload

A vulnerability was discovered in the firmware builds up to 10.10.2.2 in Poly Clariti Manager devices. The firmware flaw does not properly sanitize user input. The recommendation is to update an impacted device to firmware build 10.12.0.2100 or later. Customers can receive the latest builds throu...

CVE-2024-7323

CVE-2024-7323 affects Digiwin EasyFlow .NET, describing a lack of proper access control for a specific feature and inadequate input filtering. The vulnerability enables a remote attacker with regular privileges to download arbitrary files from the remote server. Documented metrics show CVSS v3.1 ...

CVE-2024-6346 Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks <= 2.2.85 - Authenticated (Contributor+) Stored Cross-Site Scripting via redirectURL Parameter of Date Countdown Widget

The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL parameter of the Date Countdown widget, in all versions up to, and including, 2.2.85 due to insufficient input sanitization and output escaping on user supplied...