939 matches found
CVE-2022-44637
CVE-2022-44637 affects Redmine before 4.2.9 and 5.0.x before 5.0.4, where persistent XSS can be triggered via the Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on configuration, exploitation may require login as a registered user. Root cause: insu...
CVE-2022-44031
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...
CVE-2022-44637
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
Joy Of Text Lite < 2.3.1 - Unauthenticated SQLi
The plugin does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection PoC Invoke the following curl command to induce a 5 second sleep: time curl...
GHSA-J453-HM5X-C46W Echo vulnerable to directory traversal
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
Echo vulnerable to directory traversal
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
Directory traversal
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
CVE-2020-36565 Directory traversal on Windows in github.com/labstack/echo/v4
Due to improper sanitization of user input on Windows, the static file handler allows for directory traversal, allowing an attacker to read files outside of the target directory that the server has permission to read...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the theProcess functionality due to improper user-input sanitization. PoC js var root = require"exec-local-bin" root"& touch JHU", Remediation Upgrade exec-local-bin to version 1.2.0 or higher. References - GitHub...
Sql injection
The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...
Apache Airflow 操作系统命令注入漏洞
Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is characterized by scalability and dynamic monitoring. An operating system command injection vulnerability exists in Apache Airflow Pinot Provid...
Zoho ManageEngine ServiceDesk Plus Cross-Site Scripting (CVE-2021-20080)
A stored cross-site scripting vulnerability exists in Zoho ManageEngine ServiceDesk Plus. The vulnerability is due to improper sanitization of user supplied XML...
Zoho ManageEngine ServiceDesk Cross-Site Scripting (CVE-2021-46065)
A cross-site scripting vulnerability exists in Zoho ManageEngine ServiceDesk. The vulnerability is due to improper sanitization of secondary email field parameter...
RHEL 8 : container-tools:3.0 (RHSA-2022:7529)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7529 advisory. The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fixes: golang:...
sanitize-url: XSS due to improper sanitization in sanitizeUrl function
A flaw was found in sanitize-url due to improper sanitization in the sanitizeUrl function. This issue causes vulnerability to Cross-site Scripting in sanitize-url...
GitLab Community and Enterprise Cross-Site Scripting (CVE-2022-1175)
A cross-site scripting vulnerability exists in GitLab Community and Enterprise Editions. The vulnerability is due to improper sanitization of user input submitted in notes...
CVE-2021-39473
Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting XSS due to improper sanitization of comment and contact fields...
CVE-2021-39473
Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting XSS due to improper sanitization of comment and contact fields...
