Cross site scripting

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

CVE-2023-29839

hotel druid 3.0.4 contains a Stored XSS in the Document function, affecting the fields Surname, Name, and Nickname. This is evidenced across multiple CVE records (NVD/Red Hat/OSV/etc.). The vulnerability is described as allowing arbitrary command execution. Practically, the issue is tied to input...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

CVE-2023-29839

A Stored Cross Site Scripting XSS vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function...

CVE-2023-22665 Apache Jena: Exposure of arbitrary execution in script engine expressions.

There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query...

TOTOLINK X18: UploadFirmwareFile function injection vulnerability

TOTOLINK X18 is an AX1800-grade Wi-Fi6 Mesh router system launched by TOTOLINK of China. The TOTOLINK X18 has a command injection vulnerability, which stems from the FileName parameter in the UploadFirmwareFile function not properly filtering special characters and commands. Attackers can exploit...

TOTOLINK X18 setSyslogCfg function injection vulnerability

TOTOLINK X18 is an AX1800-grade Wi-Fi6 Mesh router system launched by TOTOLINK of China. The TOTOLINK X18 has a command injection vulnerability, which stems from the fact that the parameters rtLogEnabled and rtLogServer in the setSyslogCfg function fail to properly filter special characters and...

Important: golang

Issue Overview: Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset. CVE-2022-30580 Infinite loop in...

Fedora 37 : php-Smarty (2023-4b03f6cd8a)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-4b03f6cd8a advisory. 3.1.48 - 2023-03-28 Security - Fixed Cross site scripting vulnerability in Javascript escaping. This addresses CVE-2023-28447. Fixed - Output buffer...

CVE-2023-26847

A stored cross-site scripting XSS vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the state parameter at opencats/index.php?m=candidates...

Cross site scripting

A cross-site scripting XSS vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML...

Design/Logic Flaw

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-825 1.0.9/EE routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Vimeo plugin for the xupnpd service, which listens on TCP...

Command injection

A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON object can lead to arbitrary command execution. An attacker can send a sequence of malicious packets to trigger this vulnerability...

CVE-2023-27635

CVE-2023-27635 affects debmany in Debian Goodies 0.88.1. The root cause is an eval call that allows an attacker to execute arbitrary shell commands via a crafted .deb file, with the file path shown to the user before execution. This yields a local attack vector with user interaction required (per...

Command injection

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

Code injection

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.2, watchOS 9.3, iOS 15.7.2 and iPadOS 15.7.2, Safari 16.3, tvOS 16.3, iOS 16.3 and iPadOS 16.3. Processing maliciously crafted web content may lead to arbitrary code execution...

Code injection

The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type is associated with an un-sandboxed Mono CLR interpreter...

K08827426: Vim vulnerability CVE-2022-0359

Security Advisory Description Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. CVE-2022-0359 Impact This vulnerability allows an attacker to input a specially crafted file, leading to arbitrary execution of code or potentially causing services to stop responding. Security...

TOTOLINK A7100RU 命令注入漏洞

The TOTOLINK A7100RU is a wireless router from China Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK A7100RU version V7.4cu.2313B20191024, which can be exploited by an attacker to execute arbitrary commands...