CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

Design/Logic Flaw

DISPUTED A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is...

CVE-2021-3163

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

CVE-2021-3163: Improper Neutralization of Input During Web Page Generation

A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload a crafted onloadstart attribute of an IMG element in a text field. Note: Researchers have claimed that this issue is not within the product itself, but is intended...

DEBIAN-CVE-2020-36318

In the standard library in Rust before 1.49.0, VecDeque::makecontiguous has a bug that pops the same element more than once under certain condition. This bug could result in a use-after-free or double free...

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in sebhildebrandt/systeminformation

✍️ Description The systeminformation package is vulnerable to Improper Input Validation through versions function. 🕵️‍♂️ Proof of Concept javascript // PoC.js const si = require'systeminformation'; si.versionstoString : = console.log"This is a PoC" ; 💥 Impact This vulnerability allows attackers to...

CVE-2021-24201

In the Elementor Website Builder WordPress plugin before 3.1.4, the column element includes/elements/column.php accepts an ‘htmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified...

WordPress cross-site scripting vulnerabilities

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. elementor is a drag-and-drop website builder plugin used in it. A security vulnerability exists in the WordPress plugin...

CVE-2021-29933

An issue was discovered in the insertmany crate through 2021-01-26 for Rust. Elements may be dropped twice if a .next method panics...

Devolutions Server security vulnerabilities

Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server before 2020.3, which stems from a breach of access control on the password list entry element...

Phoenix Contact Automationworx XML File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Phoenix Contact Automationworx. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Squid ESI DoS

The vulnerability of the Squid proxy server’s ESI element processing mechanism lies in the ability to limit the execution of operations within acceptable data buffer limits. Exploiting this vulnerability allows a malicious actor to cause service failures...

MCms suffers from SQL injection vulnerability (CNVD-2021-26065)

MCMS is a development template based on SpringBoot 2 architecture , front-end based on vue, element ui . MCms suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2020-6771

Loading a DLL through an Uncontrolled Search Path Element in Bosch IP Helper up to and including version 1.00.0008 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same application...

CVE-2020-6790 Uncontrolled Search Path Element in Bosch Video Streaming Gateway Installer

Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious...

CVE-2020-6789: Uncontrolled Search Path Element

Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in the same...

CVE-2020-6788: Uncontrolled Search Path Element

Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078 potentially allows an attacker to execute arbitrary code on a victim's system. A prerequisite is that the victim is tricked into placing a malicious DLL in...

PT-2021-12602

Name of the Vulnerable Software and Affected Versions: Bosch Video Streaming Gateway versions up to and including 6.45.10 Description: The issue allows an attacker to execute arbitrary code on a victim's system by calling an executable through an Uncontrolled Search Path Element in the Bosch Vide...

CVE-2020-6786: Uncontrolled Search Path Element

Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to and including version 3.81.0064 for 3.81 and 3.71 and older potentially allows an attacker to execute arbitrary code on a victim's system....

RHEL 8 : rhvm-appliance (RHSA-2021:0988)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:0988 advisory. The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is availab...