CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

PT-2023-7004 · Schneider Electric · Schneider Electric Powerlogic Ion8650 +1

Name of the Vulnerable Software and Affected Versions: Schneider Electric PowerLogic ION8650, PowerLogic ION8800 affected versions not specified Description: The issue is related to improper neutralization of input during web page generation, which could lead to compromise of a user's browser. An...

PT-2023-6925 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in handling input data in the implementation of the Pragmatic General Multicast PGM protocol in Windows. This can allow a remote attacker to execute arbitrary...

GHSA-XQ59-7JF3-RJC6 piccolo SQL Injection via named transaction savepoints

Summary The handling of named transaction savepoints in all database implementations is vulnerable to SQL Injection as user provided input is passed directly to connection.execute... via f-strings. Details An excerpt of the Postgres savepoint handling: python async def savepointself, name:...

An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.

...

PT-2023-29717 · Online Ada · Accessibility Suite

Name of the Vulnerable Software and Affected Versions: Accessibility Suite by Online ADA versions 4.12 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-15300 · Online Ada · Accessibility Suite

Name of the Vulnerable Software and Affected Versions: Accessibility Suite by Online ADA versions 4.11 through 4.12 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2023-8554 · Unknown · Neshan Maps

Name of the Vulnerable Software and Affected Versions: Neshan Maps versions 1.1.4 and earlier Description: The issue is related to the improper neutralization of special elements used in an SQL command, which allows for SQL injection attacks. This can be exploited by a remote attacker to conduct...

PT-2023-15061 · Unknown · Gopi Ramasamy Email

Name of the Vulnerable Software and Affected Versions: Gopi Ramasamy Email posts to subscribers versions n/a through 6.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...

USN-6457-1: Node.js vulnerabilities

Tavis Ormandy discovered that Node.js incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. CVE-2022-0778 Elison Niven discovered that Node.js...

phpFox Security Vulnerabilities

phpFox is a social networking platform from phpFox Inc. A security vulnerability exists in phpFox 4.8.13 and earlier versions, which stems from user input passed to the /core/redirect route via a url request parameter that is not properly cleaned up before calling the unserialize PHP function,...

Critical: squid

Issue Overview: An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer...

TOTOLINK X2000R 缓冲区错误漏洞

TOTOLINK X2000R Gh is a WiFi 6 router from China's Gion Electronics TOTOLINK, which supports Gigabit network and Easy Mesh features with multi-device connectivity and wireless expansion. The TOTOLINK X2000R Gh suffers from a buffer overflow vulnerability that stems from the formPortFw method...

USN-6449-1 ffmpeg vulnerabilities

It was discovered that FFmpeg incorrectly managed memory resulting in a memory leak. An attacker could possibly use this issue to cause a denial of service via application crash. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. CVE-2020-22038 It was discovered that FFmpeg incorrect...

USN-6422-2: Ring vulnerabilities

It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. CVE-2021-37706 It was discovered that Ring incorrectly handled...

USN-6422-2 ring vulnerabilities

It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. CVE-2021-37706 It was discovered that Ring incorrectly handled...

USN-6447-1: AOM vulnerabilities

It was discovered that AOM incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. CVE-2020-36130, CVE-2020-36131, CVE-2020-36133, CVE-2020-36135,...

CVE-2023-43803

Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint /v2/pkgs/tools/installed and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass t...

PT-2023-6174 · Oracle · Oracle Weblogic Server

Name of the Vulnerable Software and Affected Versions: Oracle WebLogic Server versions 12.2.1.4.0 through 14.1.1.0.0 Description: The issue is related to errors in handling input data in the Oracle WebLogic Server Core component. This can be exploited by a remote attacker to execute arbitrary cod...