CVE-2024-3921

The Gianism WordPress plugin through 5.1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

SQL Injection

mocodo is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of the sqlcase input field in /web/generate.php, allowing remote attackers to execute arbitrary SQL commands and potentially command injection, leading to remote code execution RCE under certain conditions...

PT-2024-28384 · WordPress · Flattr Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Flattr WordPress plugin versions 1.2.2 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

PT-2024-38977

Name of the Vulnerable Software and Affected Versions: AngularJS versions 1.3.0-rc.4 and greater Description: The issue is due to improper sanitization of the value of the srcset attribute in AngularJS, allowing attackers to bypass common image source restrictions. This can lead to a form of...

PT-2024-38978

Name of the Vulnerable Software and Affected Versions: AngularJS versions all Description: The issue is related to improper sanitization of the value of the srcset attribute in HTML elements in AngularJS, allowing attackers to bypass common image source restrictions. This can also lead to a form ...

Cross Site Scripting (XSS)

ezsystems is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization in "protected" comments, resulting in Cross Site Scripting...

Stored Cross-Site Scripting (XSS)

nocodb is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper sanitization when viewing uploaded HTML files, allowing malicious scripts to be executed when the file is opened in a browser...

CVE-2024-34341 The Trix Editor Contains an Arbitrary Code Execution Vulnerability

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker ...

CVE-2024-34341

CVE-2024-34341 (Trix editor) affects Trix prior to 2.1.1. The issue arises from improper sanitization when pasting content with markup from the web or documents, allowing arbitrary scripts to be embedded that execute in the application context. The impact is described as arbitrary code execution ...

CVE-2024-34341 The Trix Editor Contains an Arbitrary Code Execution Vulnerability

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker ...

Trix Editor Arbitrary Code Execution Vulnerability

The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker to embed malicious scripts...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improperly sanitized interface messages in the getError function. An attacker can inject malicious scripts. Note: Fixed versions: 1.39.6, 1.40.2, 1.41.1 are not in Packagist. Details Cross-site scripting ...

CVE-2024-32986 Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox

PWAsForFirefox is a tool to install, manage and use Progressive Web Apps PWAs in Mozilla Firefox. Due to improper sanitization of web app properties such as name, description, shortcuts, web apps were able to inject additional lines into XDG Desktop Entries on Linux and AppInfo.ini on...

CVE-2024-32986 Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox

PWAsForFirefox is a tool to install, manage and use Progressive Web Apps PWAs in Mozilla Firefox. Due to improper sanitization of web app properties such as name, description, shortcuts, web apps were able to inject additional lines into XDG Desktop Entries on Linux and AppInfo.ini on...

RHEL 8 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or...

Cross-site Scripting (XSS)

LibreNMS is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization on the Service template name which is reflecting in delete button onclick event. This allows malicious javascript code to be stored and executed...

CVE-2024-21511

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

CVE-2024-21511

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

CVE-2024-21511

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function...

CVE-2024-32479 LibreNMS's Improper Sanitization on Service template name leads to Stored XSS

LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. Prior to version 24.4.0, there is improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. Version 24.4.0 fixes this vulnerability...