939 matches found
Important: Red Hat Security Advisory: RHACS 3.70 security update
Updated images are now available for Red Hat Advanced Cluster Security for Kubernetes RHACS. The updated image includes bug and security fixes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which giv...
CVE-2022-1028
The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfilteredhtml ...
SUSE SLES12 Security Update : openssl-1_1 (SUSE-SU-2022:2182-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2182-1 advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by so...
CVE-2022-24278
The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...
CVE-2022-1320
The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
GHSA-PHHM-6PGM-MXW9 MODX Revolution blind SQL injection
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...
CVE-2022-28054
The CVE-2022-28054 entry affects VanDyke Software VShell for Windows 4.6.2. The root cause is improper sanitization/cleanup of trigger action scripts, which enables an attacker to execute arbitrary code by supplying a crafted value. Impact is high: remote code execution with network access and no...
CVE-2022-28054
Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...
GHSA-977V-29J9-9RXC MoinMoin improper sanitizes user profiles
MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors...
Cross-Site Scripting (XSS)
facturascripts/facturascripts is vulnerable to stored cross-site scripting. The vulnerability exists in EditPageOption.php due to improper sanitization which allows an attacker to inject and execute arbitrary scripts...
SAP BusinessObjects Business Intelligence Platform Stored XSS (3150845)
The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a stored cross-site scripting XSS vulnerability. An unauthenticated attacker can exploit this to access certain reports causing an limited impact on the confidentiality of the...
CVE-2022-28216
SAP BusinessObjects Business Intelligence Platform BI Workspace - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker due to improper sanitization of the user inputs on the network. On successful exploitation, an attacker can access certain reports causing ...
CVE-2022-26105
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...
Design/Logic Flaw
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...
CVE-2022-28542
Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Store permission...
CVE-2022-28542
CVE-2022-28542 : Samsung Galaxy Store before version 4.5.40.5 suffers from improper sanitization of incoming intents. This allows a local attacker to access privileged content providers using Galaxy Store permissions. Root cause is inadequate input sanitization of intents; affected software is Ga...
Cross-Site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to reflected cross-site scripting. The vulnerability exists in index.php due to improper sanitization which allows an attacker to inject and execute arbitrary scripts...
Remote code execution
DISPUTED The web management console of CheckMK Enterprise Edition versions 1.5.0 to 2.0.0p9 does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, eithe...
GHSA-FX95-883V-4Q4H Path traversal in github.com/valyala/fasthttp
The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only...
