PT-2022-24396 · Fortinet · Fortisoar

Name of the Vulnerable Software and Affected Versions: FortiSOAR versions 7.0.0 through 7.0.3 FortiSOAR version 7.2.0 Description: The issue is related to improper neutralization of input during web page generation, which may allow an authenticated attacker to inject HTML tags via input fields of...

CVE-2022-43556

Concrete CMS formerly concrete5 below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks...

ManageEngine SupportCenter Plus < 11.0 Build 11026 Multiple Vulnerabilities

The version of ManageEngine SupportCenter Plus prior to 11.0 Build 11026 is running on the remote web server. It is, therefore, affected by multiple vulnerabilities, including the following: - A remote code execution vulnerability due to a flaw in the Analytics Plus integration input field...

PT-2022-23218 · Churchcrm · Churchcrm

Name of the Vulnerable Software and Affected Versions: ChurchCRM version 4.4.5 Description: The issue allows attackers to store XSS via location input Deposit Comment. This enables potential malicious activities through the exploitation of this input field. Recommendations: For ChurchCRM version...

Image Hover Effects < 5.5 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. Go to the plugin settings Image Hover Effects Ima...

CVE-2022-39057

RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with administrator privilege can exploit this vulnerability to perform arbitrary system command and disrupt service...

CVE-2022-39057 Changing Information Technology Inc. RAVA certificate validation system - Command Injection

RAVA certificate validation system has insufficient filtering for special parameter of the web page input field. A remote attacker with administrator privilege can exploit this vulnerability to perform arbitrary system command and disrupt service...

Denial Of Service (DoS)

nc-lib-gui is vulnerable to denial of service. The vulnerability exists because of allowing large characters to be inserted in the input field New Project which allows an attacker to cause an application crash via a malicious input...

CVE-2022-1718

The trudesk application allows large characters to insert in the input field "Full Name" on the signup field which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request in GitHub repository polonel/trudesk prior to 1.2.2. This can lead to Denial of service...

PT-2022-23618 · Synel · Eharmony

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows an attacker to insert HTML or JavaScript code into a specific input field. To access the vulnerable input, an attacker would navigate t...

HTML Injection vulnerability in create tag functionality

Vulnerability Details In the Microweber CMS, While doing a live edit on to the application, we have the option to create a new global tag in the application. While creating a global tag, the "Tag Name" input field doesn't properly get sanitized and it's vulnerable to HTML Injection vulnerability...

CVE-2022-36323

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell...

CVE-2022-36323

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell...

CVE-2022-36323

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell...

CVE-2022-36323

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell...

CVE-2022-34768 Synel - eHarmony Stored XSS

insert HTML / js code inside input how to get to the vulnerable input : Workers worker nickname inject in this input the code...

CVE-2022-21186

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

Application allows large characters to insert in the input field "Add new table" on the create field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in

Proof of Concept Go to http://localhost:8080/dashboard//projects Select any created project and go to the project section. Click on the "ADD/IMPORT" section and click on "add new table" Create Fill the "table name" field with huge characters, more than 1 lakh Copy the below payload and put it in...

CVE-2022-32969

MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemonic, and Firefox and Chromium save such fields to disk in order to support the Restore Session feature, aka the Demonic issue...

Malicious code in @harrysforge/input-field (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e6c49a5eb4f6e3cba810d7afdecf1d956fca2c25e50bd4763bfb6481b10546a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...