1139 matches found
SUSE CVE-2020-12108
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection...
SUSE CVE-2020-15011
GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page...
WordPress Spectra Plugin <= 2.3.0 is vulnerable to Content Injection
Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-23735 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID df80536f36d8 Credits Dave Jong Patchstack Required privilege Unauthenticat...
WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Content Injection
Software RegistrationMagic Type Plugin Vulnerable versions = 5.1.9.2 Fixed in 5.1.9.3 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-23989 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 54c74a7cedb6 Credits yuyudhn Required privilege...
WordPress GPT3 AI Content Writer Plugin < 1.4.38 is vulnerable to Content Injection
Software GPT3 AI Content Writer Type Plugin Vulnerable versions 1.4.38 Fixed in 1.4.38 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-0405 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 868b79c31d14 Credits Lana Codes Required privilege...
CVE-2023-0214 XSS in Skyhigh Security SWG
A cross-site scripting vulnerability in Skyhigh SWG in main releases 11.x prior to 11.2.6, 10.x prior to 10.2.17, and controlled release 12.x prior to 12.0.1 allows a remote attacker to craft SWG-specific internal requests with URL paths to any third-party website, causing arbitrary content to be...
McAfee Skyhigh Secure Web Gateway 跨站脚本漏洞
McAfee Skyhigh Secure Web Gateway McAfee Skyhigh SWG is a series of security gateways from McAfee, Inc. A security vulnerability in McAfee Skyhigh Secure Web Gateway versions 10.x prior to 10.2.17 and 11.x prior to 11.2.6 and 12.x prior to 12.0.1 stems from a vulnerability that could allow a remo...
External Control of Assumed-Immutable Web Parameter
Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter due to improper escape of the " character in the generatemultipart function, which allows injecting malicious content to the filename parameter via the Content-Disposition header. PoC...
Ghost unauthorized newsletter modification vulnerability
Talos Vulnerability Report TALOS-2022-1624 Ghost unauthorized newsletter modification vulnerability December 21, 2022 CVE Number CVE-2022-41654 SUMMARY An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted...
Cross-site Scripting (XSS)
rails-html-sanitizer is vulnerable to cross site scripting. The vulnerability is due to the allowedtags function of sanitizer.rb which enables an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...
Rails 跨站脚本漏洞
Rails is a Ruby-based open source web application framework from the Rails team. A cross-site scripting vulnerability exists in Rails rails-html-sanitizer versions prior to 1.4.4, which stems from a possible XSS vulnerability in certain configurations of Rails::Html::Sanitizer, where...
@agentlab/ldkg-ui-basetable (0.1.1), @agentlab/ldkg-ui-charts (>=0.1.2, <=0.1.7) +131 more potentially affected by CVE-2022-23494 via tinymce (>=5.0.6, <=5.10.5)
tinymce NPM version =5.0.6, =0.1.2, =0.3.7, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.5.2, =10.3.1-snapshot-1616513687673, =1.68.82, =0.65.0, =0.18.0, =0.0.1, =0.0.7 and more Source cves: CVE-2022-23494 Source advisory: OSV:GHSA-GG8R-XJWQ-4W92...
WordPress Quiz and Survey Master plugin input validation error vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...
WordPress plugin Quiz and Survey Master 输入验证错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...
PT-2022-25351 · WordPress · Quiz/Survey Master
Name of the Vulnerable Software and Affected Versions: Quiz and Survey Master plugin for WordPress versions up to, and including, 8.0.4 Description: The issue is related to input validation bypass via the questionid parameter. Insufficient input validation allows attackers to inject content other...
PT-2022-6734 · Ruby +10 · Cgi +10
Name of the Vulnerable Software and Affected Versions: cgi gem versions 0.1.0.0 through 0.1.0.1 cgi gem versions 0.2.0 through 0.2.1 cgi gem versions 0.3.0 through 0.3.4 Description: The issue is related to HTTP response splitting, which occurs when untrusted user input is inserted into an HTTP...
rubygem-rails-html-sanitizer: possible xss with certain configurations
A Cross-site scripting XSS vulnerability exists in ruby on rails. This issue could allow an attacker to inject content into the application, leading to loss of integrity and confidentiality...
golang: net: lookup functions may return invalid host names
A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...
