Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the discriminantFormula and r1Formula processes due to improper user input sanitization. An attacker can execute arbitrary JavaScript code by injecting malicious input into the POST parameters used in...

PT-2024-32562 · Chartify · Chartify

Name of the Vulnerable Software and Affected Versions: Chartify versions n/a through 2.7.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, which leads to Reflected XSS. This problem allows for Cross-site Scripting, where an attacker can inject...

Exploit for SQL Injection in Os4Ed Opensis

UnAuthenticated SQL Injection Vulnerability in openSIS-Classic...

USN-7052-1 gnome-shell vulnerabilities

It was discovered that GNOME Shell mishandled extensions that fail to reload, possibly leading to extensions staying enabled on the lock screen. An attacker could possibly use this issue to launch applications, view sensitive information, or execute arbitrary commands. CVE-2017-8288 It was...

Ubuntu 16.04 LTS : GNOME Shell vulnerabilities (USN-7052-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7052-1 advisory. It was discovered that GNOME Shell mishandled extensions that fail to reload, possibly leading to extensions staying enabled on the lock screen. An...

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads

A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.goL113. The objects leaked are pkey​ and ctx​. That functi...

Agentic AI in SOCs: A Solution to SOAR's Unfulfilled Promises

Security Orchestration, Automation, and Response SOAR was introduced with the promise of revolutionizing Security Operations Centers SOCs through automation, reducing manual workloads and enhancing efficiency. However, despite three generations of technology and 10 years of advancements, SOAR...

CVE-2024-39842

A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs...

CVE-2024-39842: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs...

CVE-2024-31414

The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts wh...

PT-2024-24056 · Eaton · Eaton Foreseer

Name of the Vulnerable Software and Affected Versions: Eaton Foreseer software affected versions not specified Description: The issue concerns the Eaton Foreseer software, which allows users to customize the dashboard in WebView pages. However, the input fields for this feature lack proper input...

CVE-2024-5754: Reliance on Untrusted Inputs in a Security Decision

BT: Encryption procedure host vulnerability...

GHSA-M6FV-JMCG-4JFG send vulnerable to template injection that can lead to XSS

Impact passing untrusted user input - even after sanitizing it - to SendStream.redirect may execute untrusted code Patches this issue is patched in send 0.19.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...

CVE-2024-45280

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-45280

SAP NetWeaver AS Java is affected by a Cross-Site Scripting (XSS) vulnerability in the login application caused by insufficient encoding of user-controlled inputs. The issue is exploitable over the network with user interaction required, and has limited impact on confidentiality and integrity (no...

CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)

Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...

CVE-2024-42378 Cross-Site Scripting (XSS) in eProcurement on S/4HANA

Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor...

CVE-2024-42378 Cross-Site Scripting (XSS) in eProcurement on S/4HANA

Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor...

Fedora 39 : python-django4.2 (2024-28892f7c8f)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-28892f7c8f advisory. urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Tenable has extract...