975 matches found
GHSA-PHHM-6PGM-MXW9 MODX Revolution blind SQL injection
MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method resulting in authenticated user accessing database and possibly escalating privileges...
CVE-2022-28054
The CVE-2022-28054 entry affects VanDyke Software VShell for Windows 4.6.2. The root cause is improper sanitization/cleanup of trigger action scripts, which enables an attacker to execute arbitrary code by supplying a crafted value. Impact is high: remote code execution with network access and no...
CVE-2022-28054
Improper sanitization of trigger action scripts in VanDyke Software VShell for Windows v4.6.2 allows attackers to execute arbitrary code via a crafted value...
GHSA-977V-29J9-9RXC MoinMoin improper sanitizes user profiles
MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors...
Cross-Site Scripting (XSS)
facturascripts/facturascripts is vulnerable to stored cross-site scripting. The vulnerability exists in EditPageOption.php due to improper sanitization which allows an attacker to inject and execute arbitrary scripts...
SAP BusinessObjects Business Intelligence Platform Stored XSS (3150845)
The version of SAP BusinessObjects Business Intelligence Platform installed on the remote Windows host is affected by a stored cross-site scripting XSS vulnerability. An unauthenticated attacker can exploit this to access certain reports causing an limited impact on the confidentiality of the...
CVE-2022-28216
SAP BusinessObjects Business Intelligence Platform BI Workspace - version 420, is susceptible to a Cross-Site Scripting attack by an unauthenticated attacker due to improper sanitization of the user inputs on the network. On successful exploitation, an attacker can access certain reports causing ...
CVE-2022-26105
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...
Design/Logic Flaw
SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...
CVE-2022-28542
CVE-2022-28542 : Samsung Galaxy Store before version 4.5.40.5 suffers from improper sanitization of incoming intents. This allows a local attacker to access privileged content providers using Galaxy Store permissions. Root cause is inadequate input sanitization of intents; affected software is Ga...
CVE-2022-28542
Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.40.5 allows local attackers to access privileged content providers as Galaxy Store permission...
Cross-Site Scripting (XSS)
nilsteampassnet/teampass is vulnerable to reflected cross-site scripting. The vulnerability exists in index.php due to improper sanitization which allows an attacker to inject and execute arbitrary scripts...
Remote code execution
DISPUTED The web management console of CheckMK Enterprise Edition versions 1.5.0 to 2.0.0p9 does not properly sanitise the uploading of ".mkp" files, which are Extension Packages, making remote code execution possible. Successful exploitation requires access to the web management interface, eithe...
GHSA-FX95-883V-4Q4H Path traversal in github.com/valyala/fasthttp
The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only...
CVE-2021-23648
A flaw was found in sanitize-url due to improper sanitization in the sanitizeUrl function. This issue causes vulnerability to Cross-site Scripting in sanitize-url...
CVE-2022-21221
The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only...
CVE-2022-21221 Directory Traversal
The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only...
CVE-2022-21221 Directory Traversal
The package github.com/valyala/fasthttp before 1.34.0 are vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. Note: This security issue impacts Windows users only...
