FruityWifi Remote Code Execution Vulnerability

FruityWiFi is an open source tool for auditing wireless networks. A remote code execution vulnerability exists in FruityWifi 2.4 and earlier versions. The vulnerability stems from improper escaping of shell metacharacters obtained from a POST request from the pageconfigadv.php page. An attacker c...

Design/Logic Flaw

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of...

PYSEC-2020-263

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious tags, leadin...

PT-2020-20957

Name of the Vulnerable Software and Affected Versions @hapi/boom versions prior to 0.3.8 Description The issue arises from the package's failure to properly escape error messages, potentially allowing attackers to execute arbitrary JavaScript in a victim's browser. This could lead to Cross-Site...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2019:2249-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SQL Injection

catfan/Medoo is vulnerable to SQL injection. Improper escaping of user input string in the function columnQuote allows an attacker to inject and execute arbitrary SQL queries...

CVE-2019-10762

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping...

Sql injection

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping...

CVE-2019-10762

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping...

CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

CVE-2019-10757: Improper Neutralization of Special Elements used in an SQL Command

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB...

CVE-2019-14915: Improper Neutralization of Input During Web Page Generation

An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate...

PT-2019-13863

Name of the Vulnerable Software and Affected Versions PRiSE adAS version 1.7.0 Description An issue was discovered where certificate data are not properly escaped, leading to a potential XSS attack when a rogue certificate is submitted. Recommendations For PRiSE adAS version 1.7.0, consider...

PT-2019-11769 · Jenkins · Jenkins Pipeline: Build Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Build Pipeline Plugin versions 1.5.8 and earlier Description: A stored cross-site scripting issue allows attackers who can edit the build pipeline description to inject arbitrary HTML and JavaScript into the plugin-provided web pages ...

PT-2019-11758 · Jenkins · Jenkins Configuration As Code Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Configuration as Code Plugin versions 1.24 and earlier Description: The issue allows attackers with permission to change Jenkins system configuration to obtain the values of environment variables due to variable interpolation during...

Cloud Foundry UAA Information Disclosure Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.3.0 that stems from the endpoint not being properly escaped. An...

CVE-2019-11268

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

Input validation

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

CVE-2019-11268

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

CVE-2019-11268: Exposure of Sensitive Information to an Unauthorized Actor

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...