28 matches found
CVE-2026-45419 DataEase: Arbitrary File Write Vulnerability
DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase template saves call TemplateManageServicesave, StaticResourceServersaveFilesToServe, and the /de2api/templateManage/save endpoint with attacker-controlled staticResource names and Base64 content, allowing...
Cross-site Scripting (XSS)
Overview @sveltia/cms is a Sveltia CMS is a modern, lightweight, Git-based headless content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the entry summary rendering process. An attacker can execute arbitrary JavaScript in the browser of users...
CVE-2026-2973: Improper Neutralization of Input During Web Page Generation
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1 that could have allowed an authenticated user to execute arbitrary JavaScript in a user's browser due to improper sanitization of entity-encoded content in...
EUVD-2016-3071
Malware in sbrugna...
Arbitrary File Read
craftcms/cms is vulnerable to arbitrary file read. The vulnerability is due to the exploitation of the dataUrl function, which allows attackers with write permissions on system notification templates to embed and exfiltrate Base64-encoded file content via triggered email notifications...
GHSA-R32J-MR8P-HFP8 Silverstripe XSS in TreeDropdownField and TreeMultiSelectField
A cross-site scripting vulnerability has been discovered in the TreeDropdownField and TreeMultiSelectField. This vulnerability can only be exploited if a user with CMS access has posted malicious or unescaped HTML into any of the dataobjects used as a data source for either of these fields. This...
Fluent Bit security vulnerabilities
Fluent Bit is an open source log processing and analyzing system written in C. A security vulnerability exists in Fluent Bit versions 2.1.8 through 2.2.1 that stems from a null pointer dereference vulnerability that allows an attacker to construct an invalid HTTP with a content type of...
USN-6682-1 puma vulnerabilities
ZeddYu Lu discovered that Puma incorrectly handled parsing certain headers. A remote attacker could possibly use this issue to perform an HTTP Request Smuggling attack. This issue only affected Ubuntu 20.04 LTS. CVE-2020-11076 It was discovered that Puma incorrectly handled parsing certain header...
SUSE CVE-2006-6406
Clam AntiVirus ClamAV 0.88.6 allows remote attackers to bypass virus detection by inserting invalid characters into base64 encoded content in a multipart/mixed MIME file, as demonstrated with the EICAR test file...
DEBIAN-CVE-2022-39956
The OWASP ModSecurity Core Rule Set CRS is affected by a partial rule set bypass for HTTP multipart requests by submitting a payload that uses a character encoding scheme via the Content-Type or the deprecated Content-Transfer-Encoding multipart MIME header fields that will not be decoded and...
PT-2019-19831
Name of the Vulnerable Software and Affected Versions Editor.md versions 1.5.0 and earlier Editor.md all versions Description The issue involves a DOM-based XSS that can be triggered through specific vectors, including the 'EMBED SRC="data:image/svg+xml' substring. It is also reported that user...
Arbitrary file deletion
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."...
CVE-2016-3168
Removed by vendor...
CVE-2016-1982
The removechunkedtransfercoding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via crafted chunk-encoded content...
CVE-2016-1982
The removechunkedtransfercoding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via crafted chunk-encoded content...
Design/Logic Flaw
The removechunkedtransfercoding function in filters.c in Privoxy before 3.0.24 allows remote attackers to cause a denial of service invalid read and crash via crafted chunk-encoded content...
CVE-2016-1982
Affected software / component: Privoxy (filters.c, remove_chunked_transfer_coding). Vulnerability: Remote attackers can trigger a denial of service (invalid read and crash) by sending crafted chunk-encoded content. This impacts Privoxy versions before 3.0.24. Impact: Denial of Service via crafted...
PT-2016-4941
Name of the Vulnerable Software and Affected Versions Privoxy versions prior to 3.0.24 Description The issue allows remote attackers to cause a denial of service, resulting in an invalid read and crash, via crafted chunk-encoded content. This is due to a problem in the remove chunked transfer...