16123 matches found
GHSA-8J9V-4HHH-X43C Cross-Site Scripting (XSS) in TYPO3 component CSS styled content
Failing to properly encode user input, the CSS styled content component is susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript...
Cross-Site Scripting (XSS) in TYPO3 component Backend
Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site Scripting...
GHSA-3JXQ-5XHH-9JR3 Cross-Site Scripting (XSS) in TYPO3 component Backend
Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site Scripting...
SUSE CVE-2020-27823
A flaw was found in OpenJPEG's encoder. This flaw allows an attacker to pass specially crafted x,y offset input to OpenJPEG to use during encoding. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability...
SUSE CVE-2023-4399
Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, Request security is a deny list that allows admins to configure Grafana in a way so that the instance doesn't call specific hosts. However, the restriction can be bypassed used punycode encoding of the...
Cross-Site Scripting (XSS)
typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper user input encoding of notifications shown in modal windows within the TYPO3 backend, which allows an attacker with a valid backend user account to execute arbitrary JavaScript in a users browser...
Cross-Site Scripting (XSS)
typo3/cms-core is vulnerable to Cross-Site scripting XSS. The vulnerability is caused by improper user input encoding when using templates in the built-in Fluid ViewHelpers, which allows an attacker to inject malicious scripts into the browser...
Cross-Site Scripting (XSS)
typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper user input encoding, which can result in XSS when rendering files from .youtube or .vimeo. Exploitation requires a valid backend user account or write access on the server system e.g., SFTP...
PT-2024-40050
Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue is related to the bookmark toolbar, which is susceptible to Cross-Site Scripting due to improper encoding of incoming data. Recommendations At the moment, there is no informatio...
PT-2024-40196
Name of the Vulnerable Software and Affected Versions: CSS styled content component affected versions not specified Description: The CSS styled content component is susceptible to Cross-Site Scripting due to improper encoding of user input. This allows authenticated editors to inject arbitrary HT...
Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend
Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript...
Security Bulletin: Gunicorn-20.1.0-py3-none-any.whl is vulnerable to CVE-2024-1135 used in IBM Maximo Application Suite - Edge Data Collector
Summary IBM Maximo Application Suite - Edge Data Collector uses Gunicorn-20.1.0-py3-none-any.whl which is vulnerable to CVE-2024-1135 Vulnerability Details CVEID:CVE-2024-1135 DESCRIPTION: Gunicorn is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding...
Cross-Site Scripting (XSS)
typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insecurely encoding information from external sources in language pack handling, which allows attackers to execute malicious scripts in the context of the user’s browser...
RHEL 8 : mod_security_crs (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - modsecuritycrs: Content-Type or Content-Transfer-Encoding MIME header fields abuse CVE-2022-39956 - The...
RHEL 6 : nutch (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - jetty: Incorrect header handling CVE-2017-7658 - In Eclipse Jetty, versions 9.2.x and older, 9.3.x all...
ROS-20240603-04
Vulnerability of modproxy module of Apache HTTP Server web server is related to failure to take measures to process CRLF sequences in HTTP headers. CRLF sequences in HTTP headers. Exploitation of the vulnerability could allow an attacker, acting remotely to perform HTTP response splitting attacks...
RHEL 7 : cli (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - golang: encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom TokenReader CVE-2021-27918 Note th...
RHEL 8 : helm (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - golang: net/url: JoinPath does not strip relative path components in all circumstances CVE-2022-32190 -...
RHEL 8 : mcg (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - golang: encoding/pem: fix stack overflow in Decode CVE-2022-24675 Note that Nessus has not tested for this issue bu...
