golang: net/http: improper sanitization of Transfer-Encoding header

A flaw was found in golang. The HTTP/1 client accepted invalid Transfer-Encoding headers indicating "chunked" encoding. This issue could allow request smuggling, but only if combined with an intermediate server that also improperly accepts the header as invalid...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to Cross-site Scripting XSS. The vulnerability exists in setName of Rule.php due to improper sanitization of input name parameter which allows an attacker to inject and execute arbitrary javascript...

Improper Sanitization

go is vulnerable to Improper Sanitization. Whitespace characters contained outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution resulting in the vulnerability...

Cross-site Scripting (XSS)

pimcore/pimcore is vulnerable to Cross-site Scripting XSS. The vulnerability exists in getLinkContent of link.js due to improper sanitization of user inputs which allows an attacker to inject and execute arbitrary javascript...

SUSE-SU-2023:2105-2 Security update for go1.20

This update for go1.20 fixes the following issues: Update to 1.20.4 bnc1206346: - CVE-2023-24539: Fixed an improper sanitization of CSS values boo1211029. - CVE-2023-24540: Fixed an improper handling of JavaScript whitespace boo1211030. - CVE-2023-29400: Fixed an improper handling of empty HTML...

PT-2023-16964 · WordPress · Video List Manager

Name of the Vulnerable Software and Affected Versions: Video List Manager WordPress plugin versions 1.7 and earlier Description: The issue is related to a SQL injection that occurs due to improper sanitization and escaping of a parameter before it is used in a SQL statement. This can be exploited...

CVE-2023-0388

The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...

Stored Cross-site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Stored Cross-site Scripting XSS. The vulnerability exists due to the improper sanitization in the adminlog of the stat.adminlog.php, which allows an attacker to inject and execute malicious JavaScript through the $text attribute...

Cross-site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to improper sanitization in the updatecategory parameter, which allows an attacker to inject and execute malicious JavaScript...

GHSA-HCG3-56JF-X4VH safe-eval vulnerable to Prototype Pollution via the safeEval function

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...

Design/Logic Flaw

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...

CVE-2023-26121

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...

CVE-2023-26121

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...

CVE-2023-26121

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...

Cross-Site Request Forgery (CSRF)

froxlor/froxlor is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability exists in the updateTablelisting and resetTablelisting functions in ajax.php due to improper sanitization which allows an attacker to change the request to get so that a user cannot use any functions on the page...

Remote Code Execution (RCE)

apacheairflowprovidersapachesqoop is vulnerable to Remote Code Execution RCE. The vulnerability is caused by improper sanitization in sqoop.py due to the libjars parameter which allows an attacker to upload and execute malicious code on the system...

SDD Bilgisayar Yazılım SDD-Baro SQL注入漏洞

SDD Bilgisayar Yazılım SDD-Baro is an application from SDD Bilgisayar Yazılım, Turkey. A security vulnerability exists in SDD Bilgisayar Yazılım SDD-Baro versions prior to 2.8.432, which stems from an unsatisfactory neutralization of a particular element used by the software, leading to SQL...

SQL Injection

webbuilders-group/silverstripe-kapost-bridge is vulnerable to SQL Injection. The vulnerability exists due to the improper sanitization in the database and table name designer feature allowing an attacker to submit arbitrary SQL query’s, resulting in Information Disclosure...

SUSE CVE-2016-6321

Directory traversal vulnerability in the safernamesuffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the filename parameter, aka POINTYFEATHER...

CVE-2023-0261

The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber...