CSZ CMS has an unspecified vulnerability

CSZ CMS is a PHP-based open source content management system CMS. version 1.2.9 of CSZ CMS contains a security vulnerability that stems from the vulnerability of CSZ CMS to arbitrary file deletion. This can occur in PHP when the unlink function is called with user input that may affect part or th...

Argo 输入验证错误漏洞

Argo is an open source container-native workflow engine. A security vulnerability exists in Argo Workflows 3.1.3 that could allow an attacker to corrupt a workflow if EXPRESSIONTEMPLATES is enabled and an untrusted user is allowed to specify input parameters when running the workflow...

CVE-2021-37144

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization...

CVE-2021-37144

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization...

curly-bracket-parser cross-site scripting vulnerability

curly-bracket-parser is an application. A bracket parser. curly-bracket-parser suffers from a cross-site scripting vulnerability that stems from a failure to properly clean up user input when used as a template library, which can be exploited by attackers to conduct cross-site scripting attacks...

Cross-site Scripting (XSS)

curly-bracket-parser is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript in a user's browser when used as a template library due to lack of user input sanitization...

RabbitMQ < 3.8.18 XSS

Pivotal RabbitMQ versions prior to 3.8.18 are affected by a cross-site scripting XSS vulnerability in the rabbitmqfederationmanagement plugin due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user ...

GO-2021-0112 Improper input validation in go.mongodb.org/mongo-driver

Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input...

CVE-2021-23416

This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input...

CVE-2021-23416 Cross-site Scripting (XSS)

This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input...

CVE-2021-23416

CVE-2021-23416 : Cross-site Scripting in curly-bracket-parser affects all versions when used as a template library due to improper sanitization of user input. The vulnerability enables injection of malicious scripts through template processing. Public advisories (GHSA/OSV) corroborate XSS across ...

nodejs-hosted-git-info: Regular Expression denial of service via shortcutMatch in fromUrl()

A regular expression denial of service vulnerability was found in hosted-git-info. If an application allows user input into the affected regular expression regexp function, shortcutMatch or fromUrl, then an attacker could craft a regexp which takes an ever increasing amount of time to process,...

jenkins-2-plugins/credentials: Reflected XSS vulnerability in Credentials Plugin

The reflected cross-site scripting XSS vulnerability was found in jenkins credentials plugin. On a view it there is no escape from provided by user information user-controlled...

Side Menu Lite < 2.2.6 - Authenticated SQL Injection

The plugin does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to an SQL Injection issue PoC POST /wp-admin/admin.php?page=side-menu-lite=list HTTP/1.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8...

CVE-2021-36563

The CheckMK management web console versions 1.5.0 to 2.0.0 does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other client-side scripts, the XSS...

CVE-2021-36563

The CheckMK management web console versions 1.5.0 to 2.0.0 does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other client-side scripts, the XSS...

NCH Quorum Cross-Site Scripting Vulnerability

NCH Quorum is a teleconference server software. It can turn any computer into a conference call server. A cross-site scripting vulnerability exists in NCH Quorum, which stems from the product's /conferencebrowseuploadfile?confid=failure to properly handle user input data and can be exploited to...

NCH Axon PBX Cross-Site Scripting Vulnerability (CNVD-2021-55917)

NCH Axon PBX is a set of virtual telephone switch software used in commercial environments. The software is primarily used to manage telephone call centers and implements the functionality of a telephone switch in software.A cross-site scripting vulnerability exists in NCH Axon PBX, which stems...

CVE-2021-1518

A vulnerability in the REST API of Cisco Firepower Device Manager FDM On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of user input on specific...

Cisco Firepower Device Manager On-Box Software Remote Code Execution Vulnerability

A vulnerability in the REST API of Cisco Firepower Device Manager FDM On-Box Software could allow an authenticated, remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of user input on specific...