Buffer overflow

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be...

CVE-2022-0174

Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr...

CVE-2022-0174 Improper Validation of Specified Quantity in Input in dolibarr/dolibarr

Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr...

CVE-2022-0174

CVE-2022-0174 concerns an improper validation of a specified quantity in input within the Dolibarr project (dolibarr/dolibarr). Public records identify a vulnerability in Dolibarr with a CVSS v3.1 base score of 4.3 (MEDIUM) and CVSS v2 base score of 4.0 (MEDIUM). The content available notes the a...

Manipulation of the Y State Results in Interest Rate Manipulation

Handle Rhynorater Vulnerability details Impact Due to lack of constraints on user input in the TimeswapPair.solmint function, an attacker can arbitrarily modify the interest rate while only paying a minimal amount of Asset Token and Collateral Token. Disclosure: This is my first time attempting...

GHSA-Q656-G2X3-8CGH Kylin can receive user input and load any class through Class.forName(...).

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

CVE-2022-21643 SQL Injection in USOC

USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular usernames, email addresses, and passwords provided by the user were not sanitized and were used directly to construct a sql statement. Users are advised to...

Meetecho Janus 跨站脚本漏洞

Meetecho Janus is a WebRTC Web Real Time Communication server from Meetecho. A cross-site scripting vulnerability exists in the Meetecho janus gateway, which stems from the vulnerability of the janus-gateway to incorrect input during web page generation...

CVE-2021-4050

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-40095

An issue was discovered in SquaredUp for SCOM 5.2.1.6654. The Download Log feature in System / Maintenance was susceptible to a local file inclusion vulnerability when processing remote input in the log files downloaded by an authenticated administrator user, leading to the ability to read...

CVE-2020-15940

An improper neutralization of input vulnerability CWE-79 in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server...

CVE-2020-15940

An improper neutralization of input vulnerability CWE-79 in FortiClientEMS versions 6.4.1 and below and 6.2.9 and below may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server...

FortiClientEMS - Authenticated Injection vulnerabilities

An improper neutralization of input vulnerability CWE-79 in FortiClientEMS may allow a remote authenticated attacker to inject malicious script/tags via the name parameter of various sections of the server...

CVE-2021-36832

CVE-2021-36832 affects WordPress Icegram plugin versions

CVE-2021-24021

An improper neutralization of input vulnerability CWE-79 in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the column settings of Logview in FortiAnalyzer, should the...

Cross site scripting

An improper neutralization of input vulnerability CWE-79 in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the column settings of Logview in FortiAnalyzer, should the...

CVE-2021-36175

An improper neutralization of input vulnerability CWE-79 in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device...

CVE-2021-36175

An improper neutralization of input vulnerability CWE-79 in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device...

CVE-2021-36175

FortiWebManager (Fortinet) is affected by CVE-2021-36175. The issue is an input handling flaw (CWE-79) that could allow an authenticated remote attacker to inject malicious script/tags through the name, description, or comments fields in several sections of FortiWebManager. Affected versions are ...

Cross-site Scripting (XSS)

Overview teddy is a The most readable and easy to learn templating language there is! Affected versions of this package are vulnerable to Cross-site Scripting XSS. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array instead of a string. PoC...