CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting...

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting...

CVE-2023-50753

Online Notice Board System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'dd' parameter of the user/updateprofile.php resource does not validate the characters received and they are sent unfiltered to the database...

Ocs Inventory Cross-Site Scripting Vulnerability

Ocs Inventory is an asset management solution from Ocs. enabling users to inventory It assets. A cross-site scripting vulnerability exists in Ocs Inventory that stems from allowing the storage of email templates with special characters, which leads to stored cross-site scripting...

Cross-site Scripting (XSS)

prestashop/prestashop is vulnerable to Cross-Site Scripting. The vulnerability is due to the isCleanHtml function within Validate.php because it does not adequately identify and filter out HTML attributes and Unicode characters, which allows an attacker to inject malicious scripts, leading to...

GitLab 0.0 < 14.2.6 / 14.3 < 14.3.4 / 14.4 < 14.4.1 (CVE-2021-42574)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft sourc...

Potential Actions command injection in output filenames (GHSL-2023-275)

Summary The tj-actions/verify-changed-files action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. Details The verify-changed-files workflow returns the list of files changed within a workflow execution. This could...

ewen-lbh/ffcss Late-Unicode normalization vulnerability

Summary The function lookupPreprocess is meant to apply some transformations to a string by disabling characters in the regex - .. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex - .. go ...

Fedora 39 : python3.7 (2023-555b4d49b1)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-555b4d49b1 advisory. Security fix for CVE-2023-27043 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

Fedora 39 : python3.12 (2023-d577604e6a)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-d577604e6a advisory. Security fix for CVE-2023-27043 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...

OESA-2023-1940 fish security update

fish is a fully-equipped command line shell like bash or zsh that is smart and user-friendly. fish supports powerful features like syntax highlighting, autosuggestions, and tab completions that just work, with nothing to learn or configure. Security Fixes: fish is a smart and user-friendly comman...

OESA-2023-1938 fish security update

fish is a fully-equipped command line shell like bash or zsh that is smart and user-friendly. fish supports powerful features like syntax highlighting, autosuggestions, and tab completions that just work, with nothing to learn or configure. Security Fixes: fish is a smart and user-friendly comman...

Tenda i29 sysScheduleRebootSet Method Command Execution Vulnerability

The Tenda i29 is a wireless router from the Chinese company Tenda. The Tenda i29 suffers from a command execution vulnerability that stems from the sysScheduleRebootSet method failing to properly filter construct command special characters, commands, etc. The vulnerability can be exploited to cau...

CentOS 7 : firefox (RHSA-2023:6162)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6162 advisory. - VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding. CVE-2023-44488 - It was possible for certain browser prompts a...

Tenda i29 pingSet Method Command Execution Vulnerability

The Tenda i29 is a wireless router from the Chinese company Tenda. The Tenda i29 suffers from a command execution vulnerability that stems from the pingSet method failing to properly filter construct command special characters, commands, etc. The vulnerability can be exploited to cause arbitrary...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via crafted input on the interface. An attacker can manipulate the output of the web page and execute arbitrary HTML and script code in a user's browser session. Details Cross-site scripting or XSS is a code...

HTML/CSS Injection

HTML/CSS Injection is an attack that injects arbitrary characters into a web page. When an application does not properly handle user-supplied data, an attacker can supply content to a web application, typically via a parameter value which is then reflected in the page. This attack is typically us...

openSUSE 15 Security Update : fish (openSUSE-SU-2023:0404-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0404-1 advisory. - fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters...

openSUSE 15 Security Update : fish (openSUSE-SU-2023:0405-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0405-1 advisory. - fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters...

OESA-2023-1933 fish security update

fish is a fully-equipped command line shell like bash or zsh that is smart and user-friendly. fish supports powerful features like syntax highlighting, autosuggestions, and tab completions that just work, with nothing to learn or configure. Security Fixes: fish is a smart and user-friendly comman...