The vulnerability in the “classes/Master.php?f=save_field” script of the CMS system’s administration panel for the Mobile Comparison Website allows a perpetrator to perform cross-site scripting attacks.

The vulnerability in the classes/Master.php?f=savefield script of the CMS system’s administration panel for the Mobile Comparison Website is related to insufficient protection of the website structure when processing the Field Name argument. Exploiting this vulnerability allows an attacker to...

CVE-2022-23818

Insufficient input validation on the model specific register: VMHSAVEPA may potentially lead to loss of SEV-SNP guest memory integrity...

SAP CRM 跨站脚本漏洞

SAP CRM is a customer relationship management system from SAP, a German company. A cross-site scripting vulnerability exists in SAP CRM that stems from not adequately coding user-controlled input...

PT-2023-20355 · Teampass · Teampass

Name of the Vulnerable Software and Affected Versions: teampass versions prior to 3.0.7 Description: The issue is related to improper neutralization of input during web page generation, also known as cross-site scripting. In the GitHub repository nilsteampassnet/teampass, if two users have the sa...

The vulnerability of the invscout command in the IBM AIX operating system, allowing a hacker to execute arbitrary commands

The vulnerability of the invscout command in the IBM AIX operating system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

OURPHP 跨站脚本漏洞

OURPHP is OURPHP open source an open source, cross-platform, enterprise-level + e-commerce + applet + APP multi-terminal synchronization CMS station-building system. OURPHP 7.2.0 version and previous versions of the existence of cross-site scripting vulnerability , the vulnerability stems from th...

CVE-2023-29479

Ribose RNP before 0.16.3 may hang when the input is malformed...

WordPress Plugin Portfolio Slideshow 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...

The vulnerability in the web interface of the Cisco Industrial Network Director software package allows a hacker to execute arbitrary commands.

The vulnerability of the Cisco Industrial Network Director software’s web interface exists due to the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-30605

CVE-2023-30605 describes multiple SQL injection vulnerabilities in Archery, an open source SQL audit platform. The issue arises in the sql/instance.py param_edit endpoint, where user input from variable_name and variable_value is concatenated into SQL queries by several engine implementations (no...

PT-2023-2541 · Oracle · Oracle Solaris

Name of the Vulnerable Software and Affected Versions: Oracle Solaris versions 10 and 11 Description: The issue is related to errors in handling input data in the NSSwitch component of Oracle Solaris, which can be exploited to compromise the system. A successful attack can result in the takeover ...

Faturamatik Bircard SQL注入漏洞

Faturamatik Bircard is a computing e-money and payment center application from Faturamatik Turkey. An SQL injection vulnerability exists in Faturamatik Bircard versions prior to 23.04.05, which stems from improper neutralization of special elements, which can lead to SQL injection...

PT-2023-9380 · Shadow +3 · Shadow +3

Name of the Vulnerable Software and Affected Versions: Shadow version 4.13 Description: The issue is related to insufficient neutralization of special elements in a request, which can be exploited to impact data integrity. In Shadow 4.13, it is possible to inject control characters into fields...

The vulnerability of the Windows operating system’s kernel, allowing a hacker to execute arbitrary code

The vulnerability of Windows operating system kernels is related to insufficient processing of input data. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created malicious file...

USN-6016-1 node-thenify vulnerability

It was discovered that thenify incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code...

CVE-2022-43952

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability CWE-79 in FortiADC version 7.1.1 and below, version 7.0.3 and below, version 6.2.5 and below may allow an authenticated attacker to perform a cross-site scripting attack via crafted HTTP requests...

CVE-2023-27267

Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely...

Akbim Computer Panon 跨站脚本漏洞

Akbim Computer Panon is an application from Akbim, Inc. A cross-site scripting vulnerability exists in Akbim Computer Panon versions prior to 1.0.2, which arises from improper neutralization of input during web page generation...

OESA-2023-1194 curl security update

cURL is a computer software project providing a library libcurl and command-line tool curl for transferring data using various protocols. Security Fixes: libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However,...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS such that the parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to Time objects. Details Denial of Service DoS describes ...