6651 matches found
USN-3945-1 ruby1.9.1, ruby2.0, ruby2.3, ruby2.5 vulnerabilities
It was discovered that Ruby incorrectly handled certain RubyGems. An attacker could possibly use this issue to execute arbitrary commands. CVE-2019-8320 It was discovered that Ruby incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary code...
GHSA-RG3Q-JXMP-PVJJ Materialize-css vulnerable to Improper Neutralization of Input During Web Page Generation
In Materialize through 1.0.0, XSS is possible via the Toast feature...
CVE-2019-11025
In clearFilter in utilities.php in Cacti before 1.2.3, no escaping occurs before printing out the value of the SNMP community string SNMP Options in the View poller cache, leading to XSS...
A vulnerability in the library for processing and transforming HTML/XML code fragments, called Ruby Loofah, arises due to improper handling of input during web page generation. This vulnerability allows attackers to inject arbitrary JavaScript code.
The vulnerability in the library for processing and transforming HTML/XML code fragments in Ruby Loofah is related to insufficient cleaning of SVG elements in JavaScript. Exploiting this vulnerability allows a remote attacker to inject arbitrary JavaScript code...
The vulnerability in the phphandler function of the SAPI Apache2 PHP interpreter involves improper input handling during web page generation, allowing a malicious actor to perform cross-site scripting attacks.
The vulnerability of the function in phphandler sapi/apache2handler/sapiapache2.c of the SAPI Apache2 PHP interpreter is related to incorrect input handling during web page generation. Exploiting this vulnerability could allow a remote attacker to perform cross-site scripting attacks...
SQL Injection Vulnerability in Joomla! component KSA*** parameters
Joomla! is the United States Open Source Matters team developed a set of open source content management system CMS, the system provides RSS feeds , site search and other functions . A SQL injection vulnerability exists in the KSA parameter of the Joomla! component. The vulnerability stems from th...
Design/Logic Flaw
Rockwell Automation RSLinx Enterprise Software LogReceiver.exe CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it receives a datagram with an incorrect value in the “Record Data Size” field. By sendin...
Design/Logic Flaw
Rockwell Automation RSLinx Enterprise Software LogReceiver.exe CPR9, CPR9-SR1, CPR9-SR2, CPR9-SR3, CPR9-SR4, CPR9-SR5, CPR9-SR5.1, and CPR9-SR6 does not handle input correctly and results in a logic error if it calculates an incorrect value for the “End of Current Record” field. By sending a...
USN-3922-1 php7.0, php7.2 vulnerabilities
It was discovered that PHP incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information. CVE-2019-9637, CVE-2019-9638, CVE-2019-9639, CVE-2019-9640, CVE-2019-9641...
CVE-2013-2807
CVE-2013-2807 affects Rockwell Automation RSLinx Enterprise (LogReceiver.exe) across CPR9 to CPR9-SR6. The vulnerability stems from improper input handling for the Record Data Size field, enabling an oversized Datagram on UDP port 4444 that causes the service to undersize Total Record Size, trigg...
Semmle: All Burp Suite Scan report
Summary: 1. Detected Deserialization RCE: Jackson 1.1. https://lgtm-com.pentesting.semmle.net/blog/ lgtmshortsession cookie 1.2. https://lgtm-com.pentesting.semmle.net/internalapi/v0.2/getSuggestedProjects apiVersion parameter 2. Session token in URL 3. CSP: Inline scripts can be inserted 3.1...
CVE-2019-6599
In BIG-IP 11.6.1-11.6.3.2 or 11.5.1-11.5.8, or Enterprise Manager 3.1.1, improper escaping of values in an undisclosed page of the configuration utility may result with an improper handling on the JSON response when it is injected by a malicious script via a remote cross-site scripting XSS attack...
CVE-2019-9020
An issue was discovered in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1. Invalid input to the function xmlrpcdecode can lead to an invalid memory access heap out of bounds read or read after free. This is related to xmlelemparsebuf in...
The vulnerability of the software for Cisco Webex Business Suite, which exists due to the lack of measures taken to neutralize specific elements, allows a perpetrator to insert arbitrary text into the user’s browser.
The software vulnerabilities of Cisco Webex Business Suite exist due to the lack of measures taken to neutralize specific elements. Exploiting these vulnerabilities allows a malicious actor to inject arbitrary text into the user’s browser remotely...
USN-3888-1 gvfs vulnerability
It was discovered that GVfs incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information...
USN-3862-1 irssi vulnerability
It was discovered that Irssi incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service or to execute arbitrary code...
CVE-2018-18987
VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for validity, allowing attacker supplied input to be written to known memory locations. This may cause the program to crash or allow remote code execution...
WordPress Van Ons WP GDPR Compliance Plugin Elevation of Privilege Vulnerability
WordPress is a blogging platform developed by the WordPress Software Foundation using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.Van Ons WP GDPR Compliance plugin is a data collection plugin used in ... An elevation of privilege vulnerability...
Cross site scripting
In the 3.1 version of Ekushey Project Manager CRM, Stored XSS has been discovered in the input and upload sections, as demonstrated by the name parameter to the index.php/admin/client/create URI...