Cross-site Scripting (XSS)

rails-html-sanitizer is vulnerable to cross site scripting. The vulnerability is due to the allowedtags function of sanitizer.rb which enables an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to certain configurations of rails::Html::Sanitizer which allow attackers to inject content if the application developer have overridden the sanitizer's allowed tags in either of the following ways: 1 allow...

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 Impact A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject...

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. This is due to an incomplete fix of CVE-2022-32209. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 Impact A possible XSS vulnerability with certain configurations of...

PT-2022-7453

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer versions prior to 1.4.4 Description The issue is related to a possible XSS vulnerability in certain configurations of Rails::Html::Sanitizer, which may allow an attacker to inject content if the application developer has...

PT-2022-16048

Name of the Vulnerable Software and Affected Versions rails-html-sanitizer versions prior to 1.4.4 Description The issue is related to the sanitization of HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of...

Possible XSS vulnerability with certain configurations of rails-html-sanitizer

Summary There is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer. - Versions affected: ALL - Not affected: NONE - Fixed versions: 1.4.4 Impact A possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject...

DEBIAN-CVE-2022-43515

Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any user will not be able to access the Zabbix Frontend while it is being maintained and possible sensitive data will be prevented from being...

CVE-2022-38115

Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT...

Design/Logic Flaw

Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT...

PT-2022-24209 · Solarwinds · Solarwinds Sem +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns an insecure method vulnerability where allowed HTTP methods are disclosed, including OPTIONS, DELETE, TRACE, and PUT. Recommendations: At the moment, there is no...

ALSA-2022:8162 Moderate: 389-ds-base security, bug fix, and enhancement update

389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. The following packages have been upgraded to a later upstream version: 389-ds-base 2.1.3...

#bulkExecute() can reenter to steal funds

Lines of code Vulnerability details Impact ExchangebulkExecute can reenter, and internal execution of delegatecall is allowed to fail, not revert, malicious users can reenter to steal funds Proof of Concept Assumptions: There is a malicious user alice,with NFT for sale, paid through eth If user b...

GHSA-5M7G-PJ8W-7593 Vela Insecure Defaults

Impact Some current default configurations for Vela allow exploitation and container breakouts. Default Privileged Images Running Vela plugins as privileged Docker containers allows a malicious user to easily break out of the container and gain access to the worker host operating system. On a fre...

Vela Insecure Defaults

Impact Some current default configurations for Vela allow exploitation and container breakouts. Default Privileged Images Running Vela plugins as privileged Docker containers allows a malicious user to easily break out of the container and gain access to the worker host operating system. On a fre...

Login Block IPs <= 1.0.0 - IP Spoofing Bypass

The function checkisloginpage uses headers for the IP check, which can be easily spoofed. Set HTTPCLIENTIP to bypass blocks / use allowed IP addresses...

PT-2022-14898 · Unknown · Express-Xss-Sanitizer

Name of the Vulnerable Software and Affected Versions: express-xss-sanitizer versions prior to 1.1.3 Description: The issue allows attackers to bypass xss sanitization due to Prototype Pollution via the allowedTags attribute. This enables the attacker to exploit the vulnerability, potentially...

Express XSS Sanitizer 安全漏洞

Express XSS Sanitizer is a personal development by AhmedAdelFahim to clean user input data in req.body, req.query, req.headers and req.params to prevent cross-site scripting XSS attacks. express XSS Sanitizer A prototype contamination vulnerability exists in versions prior to 1.1.3, which stems...

Prototype Pollution

Overview express-xss-sanitizer is an Express 4.x middleware which sanitizes user input data in req.body, req.query, req.headers and req.params to prevent Cross Site Scripting XSS attack. Affected versions of this package are vulnerable to Prototype Pollution via the allowedTags attribute, allowin...

PT-2022-34084 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.10.137 Description: The issue is related to a potential panic in the dl cpu busy function due to an empty cs-cpus allowed. The actual impact and attack plausibility have not yet been proven. Recommendations:...