PT-2019-12217

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions prior to 73.3.0 Description The issue concerns improper escaping in certain endpoints, allowing an authenticated malicious user with basic read privileges for one identity zone to extend those privileges to all other...

jenkins: Improper escaping of job URLs in f:validateButton leads to cross-site scripting vulnerability.

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting XSS vulnerability exploitable by users with the ability to control job names...

PT-2019-20001

Name of the Vulnerable Software and Affected Versions squel versions affected versions not specified Description The issue concerns sql injection due to improper escaping of user-provided input when using the setFields method. This could lead to sql injection if the query was then executed. A pro...

PT-2019-20027

Name of the Vulnerable Software and Affected Versions sql affected versions not specified Description The issue is related to sql injection due to improper escaping of parameters when building SQL queries. There is no information available about the estimated number of potentially affected device...

PT-2019-12499

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 3.9.6 Description A potential XSS attack vector exists due to the debug views of com users not properly escaping user-supplied data. Recommendations For versions prior to 3.9.6, update to version 3.9.6 or later to...

CVE-2019-0857: Improper Encoding or Escaping of Output

A spoofing vulnerability that could allow a security feature bypass exists in when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Spoofing Vulnerability'...

CVE-2019-6599

In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting XSS attack...

GHSA-F7PH-P5RV-PHW2 Cross-Site Scripting in nunjucks

Affected versions of nunjucks do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability. Proof of Concept By using an array for the keys in a template var, escaping is bypassed. javascript name=alert1 A full...

Dojo Toolkit 1.13 Cross Site Scripting

Advisory ID: SYSS-2018-010 Product: Dojo Toolkit Manufacturer: JS Foundation Affected Versions: 1.13 Tested Versions: 1.13, 1.10.7 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-07-02 Solution Date: 2018-10-13 Public...

bui select component cross-site scripting vulnerability

bui is a front-end framework based on JQuery. select component is one of the search component. A cross-site scripting vulnerability exists in the select component in bui 2018-03-13 and prior versions, which stems from a program performing an escape operation on escaped text. A remote attacker can...

Back In Time: Command injection

Background A simple backup tool for Linux, inspired by “flyback project”. Description ‘Back in Time’ did improper escaping/quoting of file paths used as arguments to the ‘notify-send’ command leading to some parts of file paths being executed as shell commands within an os.system call. Impact A...

PT-2017-13957

Name of the Vulnerable Software and Affected Versions PSFTPd version 10.0.4 Build 729 Description The issue allows attackers to hide data in the Graphical User Interface GUI view and create arbitrary entries to a certain extent by not properly escaping data before writing it into a Comma Separate...

Input validation

backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...

CVE-2017-16667

backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...

CVE-2017-16667

backintime aka Back in Time before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft...

CVE-2017-16667

CVE-2017-16667 - Summary : The Back in Time tool (backintime) prior to version 1.1.24 improperly escapes/quotes file paths passed to the notify-send command, causing parts of the path to be executed as shell commands inside an os.system call in qt4/plugins/notifyplugin.py. This enables a context-...

PT-2017-19446

Name of the Vulnerable Software and Affected Versions webmin versions prior to 1.840 Description A cross-site scripting XSS issue and an issue due to improper escaping in the download module have been identified. The estimated number of potentially affected devices worldwide is not available. The...

CVE-2017-3165

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...

CVE-2017-3165: Improper Neutralization of Input During Web Page Generation

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to ...

PT-2017-15697

Name of the Vulnerable Software and Affected Versions Apache Brooklyn versions prior to 0.10.0 Description The issue allows one authenticated user to cause scripts to run in the browser of another user authorized to access the first user's resources through cross-site scripting. This is due to...