Magento Commerce跨站脚本漏洞

Magento Commerce is to provide a first-class shopping experience without the need for developer support. Magento Commerce suffers from a cross-site scripting vulnerability that exists due to insufficient cleaning of user-supplied data. A remote attacker can exploit this vulnerability to inject an...

The vulnerability of Adobe Experience Manager’s content and media management system, related to the lack of measures for cleaning incoming data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Ruby library for parsing Markdown in HTML Redcarpet, related to the lack of protection for website structure, allows attackers to compromise the integrity of the protected information.

The vulnerability of the Ruby library for parsing Markdown in HTML Redcarpet is related to improper cleaning of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

The vulnerability of the files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc, which are used for installing, updating, and removing software packages in the Apt suite, relates to integer overflow vulnerabilities. This allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc files, which are used for installing, updating, and removing software packages, is related to the lack of data cleaning. Exploiting this vulnerability can allow an attacker to access...

The vulnerability of the bleach-based HTML cleaning library, which exists due to the lack of measures taken to protect the structure of web pages, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the bleach HTML cleaning library exists because measures to protect the structure of web pages are not taken. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the software for implementing the hypertext environment MediaWiki allows a perpetrator to compromise the confidentiality of the protected information.

The vulnerability of the software for implementing the hypertext environment MediaWiki arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious individual to compromise the confidentiality of the protected information due to...

The vulnerability of the Cleaner class in the Lxml library for processing XML and HTML markup allows a hacker to execute arbitrary Java Script code.

The vulnerability of the Cleaner class in the Lxml library for processing XML and HTML markup is related to the lack of measures to clean incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary Java Script code...

The vulnerability of the IBM DB2 database management system lies in the insufficient cleaning of special elements in the output data used by the incoming component, which allows a hacker to trigger a service failure.

The vulnerability of the IBM DB2 database management system is related to insufficient cleaning of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using specially created commands...

The vulnerability of the Veritas InfoScale backup and data storage application, the Veritas Access data storage system, and the Veritas Cluster Server (VCS) application for clustering open systems lies in the absence of measures to clean incoming data. This allows a malicious actor to execute arbitrary commands.

The vulnerability of the Veritas InfoScale backup and data storage application, the Veritas Access data storage system, and the Veritas Cluster Server VCS for clustering open systems is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote...

The vulnerability in the virtual training environment Moodle arises due to insufficient cleaning of data provided by users in XML-RPC calls, allowing attackers to execute arbitrary SQL queries.

The vulnerability in the virtual training environment Moodle exists due to insufficient cleaning of data provided by users in XML-RPC calls. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability in the virtual learning environment Moodle arises from insufficient cleaning of data provided by users at the final authentication stage of LTI. This allows attackers to execute cross-site scripting (XSS) attacks.

The vulnerability in the virtual learning environment Moodle exists due to insufficient cleaning of data provided by users at the final authentication stage of LTI. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server lies in insufficient cleaning of input data, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft SharePoint Server, SharePoint Foundation, and SharePoint Enterprise Server relates to insufficient cleaning of input data. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

Elastic Kibana 输入验证错误漏洞

Elastic Kibana is an application from the Dutch company Elastic. A free and open user interface that enables you to visualize Elasticsearch data and lets you navigate through the Elastic Stack. Elastic Kibana suffers from an input validation error vulnerability that stems from incorrect cleaning ...

The vulnerability of the process of updating microprogramming software for Cisco Adaptive Security Appliance Software (ASA) and Cisco Firepower Threat Defense (FTD) allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the process of updating microprogramming software for Cisco Adaptive Security Appliance Software ASA and Cisco Firepower Threat Defense FTD is related to the failure to take measures to clean data at the management level. Exploiting this vulnerability can allow attackers to...

The vulnerability of the CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS, FD1616SN, FD8000 are related to the failure to take measures for data cleaning at the management level. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of optical line terminal devices such as CDATA 72408A, 9008A, 9016A, 92408A, 92416A, 9288, 97016, 97024P, 97028P, 97042P, 97084P, 97168P, FD1002S, FD1104, FD1104B, FD1104S, FD1104SN, FD1108S, FD1204S-R2, FD1204SN, FD1204SN-R2, FD1208S-R2, FD1216S-R1, FD1608GS, FD1608SN, FD1616GS...

The vulnerability of microprogrammed software in wireless controllers from NETGEAR, such as WC7500, WC7600, WC7600v2, and WC9500, arises due to insufficient cleaning of input data. This allows a intruder to execute arbitrary commands.

The vulnerability of microprogrammed wireless controller software from NETGEAR, including WC7500, WC7600, WC7600v2, and WC9500, is related to insufficient cleaning of input data. Exploiting this vulnerability can allow an intruder to execute arbitrary commands...

Fake Trezor app steals more than $1 million worth of crypto coins

Several users of Trezor, a small hardware device that acts as a cryptocurrency wallet, have been duped by a fake app with the same name. The app was available on Google Play and Apple’s App Store and also claimed to be from SatoshiLabs, the creators of Trezor. According to the Washington Post, th...

The vulnerability of NETGEAR R6220 and R6230 Wi-Fi router microprogramming software, related to insufficient cleaning of input data, allows a intruder to execute arbitrary commands.

The vulnerability of NETGEAR R6220 and R6230 Wi-Fi routers’ microprogramming software is related to insufficient cleaning of input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of the Yaws CGI web server lies in the lack of measures to neutralize special elements, which allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Yaws CGI web server implementation is related to improper cleaning of CGI requests. Exploiting this vulnerability can allow an attacker who operates remotely to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the implementation of the GPU-based terminal emulator protocol in GPU Kitty relates to the absence of measures to neutralize special elements. This allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the GPU-based terminal emulator’s protocol implementation is related to the lack of filename cleaning when returning error messages. Exploiting this vulnerability can allow remote attackers to gain access to confidential data, compromise its integrity, and cause service...