Path Traversal

github.com/fluxcd/flux2 is vulnerable to path traversal. The vulnerability exists because the library does not properly handle the user-supplied input, allowing an attacker to access files outside the expected directory and replace the flux deployment information with arbitrary content...

PT-2022-20256 · Unknown · Rosariosis

Name of the Vulnerable Software and Affected Versions: rosariosis versions prior to 8.9.3 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation, allowing an attacker to inject malicious scripts. This ca...

moment: inefficient parsing algorithm resulting in DoS

A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service ReDoS attacks...

CVE-2022-36035

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration like Git repositories, and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allow...

Path traversal

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration like Git repositories, and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allow...

CVE-2022-36035 Flux CLI Workload Injection

Flux is a tool for keeping Kubernetes clusters in sync with sources of configuration like Git repositories, and automating updates to configuration when there is new code to deploy. Flux CLI allows users to deploy Flux components into a Kubernetes cluster via command-line. The vulnerability allow...

Flux2 路径遍历漏洞

Flux2 is a tool from the Cloud Native Computing Foundation that keeps Kubernetes clusters synchronized with their configuration sources. A path traversal vulnerability exists in Flux2 versions v0.21.0 through v0.31.0, which stems from mishandling of user-supplied input and can be exploited by an...

GHSA-7HFP-QFW3-5JXH Helm Vulnerable to denial of service through string value parsing

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified input to functions in the strvals package that can cause an out of memory panic. Out of memory panics cannot be recovered from. Applications that use functions from the strvals package in the Helm SDK can have a Denial of Service...

Remote Code Execution

morgan-json is vulnerable to remote code execution. The vulnerability exists due to the missing sanitizations of user input passed to the module.exports function, which allows remote attackers to inject and execute malicious code...

CVE-2022-38118

Affected software: OAKlouds Portal Meeting Room. The issue is a SQL injection caused by insufficient input validation. A remote attacker with general user privileges can access, modify, delete the database, perform system operations, and disrupt service. CVSS v3.1 base score 8.8 (AV:N/AC:L/PR:L/U...

PT-2022-24212 · Unknown · Oaklouds Portal

Name of the Vulnerable Software and Affected Versions: OAKlouds Portal affected versions not specified Description: The issue is related to insufficient validation for user input in the Meeting Room of the OAKlouds Portal website. This allows a remote attacker with general user privileges to...

Cross-site Scripting (XSS)

github.com/phachon/mm-wiki is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of the user input allowing an attacker to inject maliciously crafted script into the system...

CVE-2022-37150

An issue was discovered in Online Diagnostic Lab Management System 1.0. There is a stored XSS vulnerability via firstname, address, middlename, lastname , gender, email, contact parameters...

PT-2022-23459 · Unknown · Edoc-Doctor-Appointment-System

Name of the Vulnerable Software and Affected Versions: Edoc-doctor-appointment-system version 1.0.1 Description: The issue is related to a reflected cross-site scripting XSS vulnerability. This vulnerability is located at the "/patient/index.php" API endpoint and allows attackers to execute...

PT-2022-23460

Name of the Vulnerable Software and Affected Versions Edoc-doctor-appointment-system version 1.0.1 Description The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability is located at the "/patient/settings.php" API endpoint and allows attackers to execute arbitra...

Cross site scripting

It was found that the smallrye health metrics UI component did not properly sanitize some user inputs. An attacker could use this flaw to conduct cross-site scripting attacks...

CVE-2022-20865 Cisco FXOS Software Command Injection Vulnerability

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The attacker would need to have Administrator privileges on the device. This vulnerability is due to insufficient input validation of...

Ajax Load More < 5.5.4.1 - Admin+ Arbitrary File Read

The plugin does not properly validates paths generated with user input in the almrepeatersexport function, which could allow high privilege users to read arbitrary files form the server even when they should not be able to have access to any, for example in multisite setup This is due to an...

EUVD-2022-33040

Frappe ERPNext 12.29.0 is vulnerable to XSS where the software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is used as a web page that is served to other users...

WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC As admin, put the following payload in the "Provide your IP-API Pro key", "Memcached Server Host", "Set the...