CVE-2023-2541: Exposure of Sensitive System Information to an Unauthorized Control Sphere

The Web Frontend of KNIME Business Hub before 1.4.0 allows an unauthenticated remote attacker to access internals about the application such as versions, host names, or IP addresses. No personal information or application data was exposed...

Phoenix Contact ENERGY AXC PU Path Traversal (CVE-2023-1109)

In Phoenix Contacts ENERGY AXC PU Web service an authenticated restricted user of the web frontend can access, read, write and create files throughout the file system using specially crafted URLs via the upload and download functionality of the web service. This may lead to full control of the...

SUSE CVE-2019-20378

ganglia-web aka Ganglia Web Frontend through 3.7.5 allows XSS via the header.php ce parameter...

SUSE CVE-2019-20379

ganglia-web aka Ganglia Web Frontend through 3.7.5 allows XSS via the header.php cs parameter...

CVE-2021-31740

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

Cross site scripting

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

CVE-2021-31740: Improper Neutralization of Input During Web Page Generation

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

CVE-2021-31740

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

CVE-2021-31740

SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities XSS...

CVE-2021-31740

CVE-2021-31740 affects SEPPMail’s web frontend. The vulnerability is a cross-site scripting (XSS) flaw caused by user input not embedded correctly in the web page. Reported impact is limited to confidentiality and integrity (both Low) with no availability impact, CVSS 3.1: 6.1 (Network, Low/Low/N...

OESA-2022-2073 ganglia security update

Ganglia is a scalable, real-time monitoring and execution environment with all execution requests and statistics expressed in an open well-defined XML format. Security Fixes: ganglia-web aka Ganglia Web Frontend through 3.7.5 allows XSS via the header.php ce parameter.CVE-2019-20378 ganglia-web a...

Malicious Package

Overview common-web-frontend-styling is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

UBUNTU-CVE-2022-31086

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 incorrect regular expressions allow to upload PHP scripts to config/templates/pdf. This vulnerability could lead to a Remote Code Execution if the...

MAL-2022-7069 Malicious code in web-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6072960685ef2154e26a6d650399a02fc1bc892374cd849d71cb5324f6ae4b51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6072960685ef2154e26a6d650399a02fc1bc892374cd849d71cb5324f6ae4b51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-166 Malicious code in @ch-post-common/common-web-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 909faab73232acee1d72b62ae9370a819f55eb8de3c14ac9b8c3993d381dd54c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ch-post-common/common-web-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 909faab73232acee1d72b62ae9370a819f55eb8de3c14ac9b8c3993d381dd54c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-24851

LDAP Account Manager LAM is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS...

CVE-2022-24851 Stored XSS and path traversal in LDAPAccountManager/lam

LDAP Account Manager LAM is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS...

CVE-2022-24851

CVE-2022-24851 affects LDAP Account Manager (LAM). The stored XSS flaws occur in the profile editor (edit profile) and in the pdf editor (logoFile path handling), with attacker-controlled payloads when logged into the LAM admin interface. Both issues require an authenticated admin user to exploit...