Path Traversal (Zip Slip)

github.com/artdarek/go-unzip is vulnerable to Zip Slip. The vulnerability is due to improper handling of file paths within an archive. An attacker can construct an archive containing files with arbitrary paths which results in arbitrary file write outside of the restricted target directory during...

Information Disclosure

nonebot2 is vulnerable to Information Disclosure. The vulnerability is due to improper handling of user-provided data in a MessageTemplate, which could result in sensitive information disclosure if the user input is used in templates without adequate filtering...

Denial Of Service (DoS)

com.liferay.portal:release.portal.bom is vulnerable to Denial Of Service DoS. The vulnerability is due improper resource consumption limits while generating a preview image. A remote, authenticated attacker can cause a DoS via a crafted image...

PT-2024-19633 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: A vulnerability notification is available, but details about the issue are not provided. No information is available about potentially affected...

PPWP – Password Protect Pages < 1.9.0 - Protection Mechanism Bypass

Description The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.9 via API. This makes it possible for unauthenticated attackers to obtain post titles, IDs, slugs as well as other information including for...

CVE-2023-45227

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

CVE-2023-45222

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

Cross site scripting

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

Cross site scripting

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

Cross site scripting

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

CVE-2023-40143

CVE-2023-40143 affects Westermo Lynx web interface. A cross-site scripting flaw allows an attacker who can access the Lynx web application to inject arbitrary JavaScript via the forward.0.domain parameter. Public sources (NVD/Nessus plugin) assign CVSS v3.1 base score 5.4 (Network, Low attack com...

CVE-2023-45222 Westermo Lynx Cross-site Scripting

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

CVE-2023-45222

CVE-2023-45222 affects the Westermo Lynx 206-F2G web interface (WeOS) where an attacker with access to the web app can inject arbitrary JavaScript via the autorefresh parameter (Cross-Site Scripting, CWE-79). Public disclosures (NVD/NIST, Tenable OT plugin, CNVD, PRION, CVE list) describe identic...

CVE-2023-45227 Westermo Lynx Cross-site Scripting

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

CVE-2023-45227

Westermo Lynx 206-F2G (WeOS) CVE-2023-45227 is a Cross-Site Scripting vulnerability due to improper input neutralization in the web page generation for the dns.0.server parameter (CWE-79). An attacker with access to the vulnerable web application could inject arbitrary JavaScript, with the issue ...

CVE-2023-45227 Westermo Lynx Cross-site Scripting

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

Denial Of Service

indent is vulnerable to Denial Of Service. The vulnerability is due to a flaw in the program's handling of specially crafted files, potentially allowing an attacker to crash the application by tricking a user into processing such files...

PT-2024-19473 · Beetl · Beetl

Name of the Vulnerable Software and Affected Versions: Beetl versions prior to 3.15.12 Description: The rendering template in Beetl has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklis...

PT-2024-40814 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow READ 8 crash. The crash state involves functions such as mrb memsearch, mrb str split m, and mrb vm exec. ...

Cross Site Scripting (XSS)

@tanstack/react-query-next-experimental is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of the id variable within the createHydrationStreamProvider method, which allows an attacker to inject arbitrary JavaScript when react-query-next-experimental preforms...