Alkacon OpenCMS XSS via New User module

Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the theme color-code values. An attacker can execute arbitrary scripts in the context of the user's browser by crafting malicious input that is rendered when a user customizes theme colors. Details Cross-sit...

CVE-2022-28105

Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/viewfacility.php...

Cross-site Scripting (XSS)

Overview mantisbt/mantisbt is a mantis bug tracker. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the browsersearchplugin.php file. An attacker can inject malicious scripts into a hidden input field by manipulating the unescaped output of the return parameter...

Denial Of Service (DoS)

chrome is vulnerable to denial of service. The vulnerability exists due to an Inappropriate implementation in Input...

SQL Injection

blazer is vulnerable to sql injection attacks. The library does not properly sanitize user input which allows an attacker to inject malicious sql queries and modify system data...

IBM ISS BlackICE PC 跨站脚本漏洞

The IBM ISS BlackICE PC is a personal firewall/IDS for Windows desktops from IBM USA. A security vulnerability exists in IBM ISS BlackICE PC Protection that originates from an operation using unknown input that results in cross-site scripting. An attacker could exploit the vulnerability to conduc...

CVE-2021-40906

CheckMK Raw Edition software versions 1.5.0 to 1.6.0 does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser such as JavaScript or other...

Important: Red Hat Security Advisory: cyrus-sasl security update

An update for cyrus-sasl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

ALSA-2022:0658 Important: cyrus-sasl security update

The cyrus-sasl packages contain the Cyrus implementation of Simple Authentication and Security Layer SASL. SASL is a method for adding authentication support to connection-based protocols. Security Fixes: cyrus-sasl: failure to properly escape SQL input allows an attacker to execute arbitrary SQL...

Privilege Escalation

microweber/microweber is vulnerable to privilege escalation. The use of one-time coupon multiple time allows an attacker to manipulate One-Time-Coupon Handler using malicious input...

The vulnerability of the implementation of the SetWLanACLSettings() function in D-Link DIR-823-Pro wireless router software allows a hacker to execute arbitrary commands.

The vulnerability of the implementation of the SetWLanACLSettings function in D-Link DIR-823-Pro wireless router microprogramming software is related to insufficient cleaning of input data during the processing of the parameter wl0.0maclist. Exploiting this vulnerability allows a remote attacker ...

CVE-2021-22802

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user supplied data, when a constructed message is received on the network. Affected Product: Interactive Graphical SCADA System Data Collector dc.ex...

Remote code execution

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user supplied data, when a constructed message is received on the network. Affected Product: Interactive Graphical SCADA System Data Collector dc.ex...

CVE-2021-22802

Schneider Electric IGSS Data Collector (dc.exe), affected in IGSS v15.0.0.21243 and earlier, is vulnerable to a CWE-120 buffer overflow due to missing length checks on user-supplied data while processing a network-constructed message. This can lead to remote code execution with the dc.exe process...

Buffer overflow

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be...

CVE-2022-0174

Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr...

CVE-2022-0174 Improper Validation of Specified Quantity in Input in dolibarr/dolibarr

Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr...

CVE-2022-0174

CVE-2022-0174 concerns an improper validation of a specified quantity in input within the Dolibarr project (dolibarr/dolibarr). Public records identify a vulnerability in Dolibarr with a CVSS v3.1 base score of 4.3 (MEDIUM) and CVSS v2 base score of 4.0 (MEDIUM). The content available notes the a...

Manipulation of the Y State Results in Interest Rate Manipulation

Handle Rhynorater Vulnerability details Impact Due to lack of constraints on user input in the TimeswapPair.solmint function, an attacker can arbitrarily modify the interest rate while only paying a minimal amount of Asset Token and Collateral Token. Disclosure: This is my first time attempting...