Cross site scripting

A cross-site scripting XSS vulnerability exists in templatesimport.php Cacti 1.2.13 due to Improper escaping of error message during template import preview in the xmlpath field...

CVE-2020-25706

A cross-site scripting XSS vulnerability exists in templatesimport.php Cacti 1.2.13 due to Improper escaping of error message during template import preview in the xmlpath field...

FruityWifi Remote Code Execution Vulnerability

FruityWiFi is an open source tool for auditing wireless networks. A remote code execution vulnerability exists in FruityWifi 2.4 and earlier versions. The vulnerability stems from improper escaping of shell metacharacters obtained from a POST request from the pageconfigadv.php page. An attacker c...

Design/Logic Flaw

An issue was discovered in MantisBT before 2.24.3. When editing an Issue in a Project where a Custom Field with a crafted Regular Expression property is used, improper escaping of the corresponding form input's pattern attribute allows HTML injection and, if CSP settings permit, execution of...

PYSEC-2020-263

A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious tags, leadin...

openSUSE: Security Advisory for MozillaThunderbird (openSUSE-SU-2019:2249-1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

SQL Injection

catfan/Medoo is vulnerable to SQL injection. Improper escaping of user input string in the function columnQuote allows an attacker to inject and execute arbitrary SQL queries...

CVE-2019-10762

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping...

Sql injection

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping...

CVE-2019-10762

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping...

PT-2019-11769 · Jenkins · Jenkins Pipeline: Build Step Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Build Pipeline Plugin versions 1.5.8 and earlier Description: A stored cross-site scripting issue allows attackers who can edit the build pipeline description to inject arbitrary HTML and JavaScript into the plugin-provided web pages ...

PT-2019-11758 · Jenkins · Jenkins Configuration As Code Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Configuration as Code Plugin versions 1.24 and earlier Description: The issue allows attackers with permission to change Jenkins system configuration to obtain the values of environment variables due to variable interpolation during...

Cloud Foundry UAA Information Disclosure Vulnerability

Cloud Foundry UAA is an authentication and managed service endpoint for the CloudFoundry cloud platform from the Cloud Foundry Foundation in the United States. A security vulnerability exists in Cloud Foundry UAA versions prior to 73.3.0 that stems from the endpoint not being properly escaped. An...

CVE-2019-11268

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

Input validation

Cloud Foundry UAA version prior to 73.3.0, contain endpoints that contains improper escaping. An authenticated malicious user with basic read privileges for one identity zone can extend those reading privileges to all other identity zones and obtain private information on users, clients, and grou...

jenkins: Improper escaping of job URLs in f:validateButton leads to cross-site scripting vulnerability.

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting XSS vulnerability exploitable by users with the ability to control job names...

CVE-2019-6599

In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting XSS attack...

GHSA-F7PH-P5RV-PHW2 Cross-Site Scripting in nunjucks

Affected versions of nunjucks do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability. Proof of Concept By using an array for the keys in a template var, escaping is bypassed. javascript name=alert1 A full...

Dojo Toolkit 1.13 Cross Site Scripting

Advisory ID: SYSS-2018-010 Product: Dojo Toolkit Manufacturer: JS Foundation Affected Versions: 1.13 Tested Versions: 1.13, 1.10.7 Vulnerability Type: Cross-Site Scripting CWE-79 Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2018-07-02 Solution Date: 2018-10-13 Public...

bui select component cross-site scripting vulnerability

bui is a front-end framework based on JQuery. select component is one of the search component. A cross-site scripting vulnerability exists in the select component in bui 2018-03-13 and prior versions, which stems from a program performing an escape operation on escaped text. A remote attacker can...