Cross-site Scripting (XSS)

rails-html-sanitizer is vulnerable to cross site scripting. The vulnerability is due to the allowedtags function of sanitizer.rb which enables an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

Rails 跨站脚本漏洞

Rails is a Ruby-based open source web application framework from the Rails team. A cross-site scripting vulnerability exists in Rails rails-html-sanitizer versions prior to 1.4.4, which stems from a possible XSS vulnerability in certain configurations of Rails::Html::Sanitizer, where...

@agentlab/ldkg-ui-basetable (0.1.1), @agentlab/ldkg-ui-charts (>=0.1.2, <=0.1.7) +131 more potentially affected by CVE-2022-23494 via tinymce (>=5.0.6, <=5.10.5)

tinymce NPM version =5.0.6, =0.1.2, =0.3.7, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.5.2, =10.3.1-snapshot-1616513687673, =1.68.82, =0.65.0, =0.18.0, =0.0.1, =0.0.7 and more Source cves: CVE-2022-23494 Source advisory: OSV:GHSA-GG8R-XJWQ-4W92...

WordPress Quiz and Survey Master plugin input validation error vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

WordPress plugin Quiz and Survey Master 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

PT-2022-25351 · WordPress · Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: Quiz and Survey Master plugin for WordPress versions up to, and including, 8.0.4 Description: The issue is related to input validation bypass via the questionid parameter. Insufficient input validation allows attackers to inject content other...

PT-2022-6734 · Ruby +10 · Cgi +10

Name of the Vulnerable Software and Affected Versions: cgi gem versions 0.1.0.0 through 0.1.0.1 cgi gem versions 0.2.0 through 0.2.1 cgi gem versions 0.3.0 through 0.3.4 Description: The issue is related to HTTP response splitting, which occurs when untrusted user input is inserted into an HTTP...

rubygem-rails-html-sanitizer: possible xss with certain configurations

A Cross-site scripting XSS vulnerability exists in ruby on rails. This issue could allow an attacker to inject content into the application, leading to loss of integrity and confidentiality...

golang: net: lookup functions may return invalid host names

A flaw was found in Go. The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions in the net package and methods on the Resolver type, may return arbitrary values retrieved from DNS, allowing injection of unexpected contents. The highest threat from this vulnerability is to integri...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

Unrestricted file upload

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

UBUNTU-CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

CVE-2022-37426

Technical details (affected components, versions, root cause, and fixes) are not publicly provided in the supplied connected documents. Monitor for updates from vendors and security bulletins.

CVE-2022-37426

Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection...

OpenNebula 代码问题漏洞

OpenNebula is an OpenNebula open source cloud computing platform for managing heterogeneous distributed data center infrastructures. A security vulnerability exists in OpenNebula that stems from the presence of an unlimited upload of dangerous types of files vulnerability that allows file content...

UBUNTU-CVE-2022-2527

An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim...