Denial Of Service (DoS)

libgpac.so is vulnerable to Denial Of Service. The vulnerability exists in the afrtboxread function of boxcodeadobe.c file due to a memory leak, which allows an attacker to send crafted inputs into the system causing an application crash...

CVE-2023-22726

act is a project which allows for local running of github actions. The artifact server that stores artifacts from Github Action runs does not sanitize path inputs. This allows an attacker to download and overwrite arbitrary files on the host from a Github Action. This issue may lead to privilege...

CVE-2023-23596

jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an...

act 路径遍历漏洞

github act is a tool for running GitHub Actions locally. act suffers from a path traversal vulnerability that stems from the fact that path inputs are not cleaned up, leading to privilege escalation...

CVE-2023-23014

Cross Site Scripting XSS vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c on Apr 23, 2021 via editstorename and editactive inputs in file InventorySystem.php...

Cross-Site Scripting (XSS)

@mattkrick/sanitize-svg is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to improper sanitization of user inputs in the deny-list-pattern which allows an attacker to inject and execute arbitrary JavaScript...

gatsby 跨站脚本漏洞

gatsby is a software application. A free open source framework based on React that helps developers build extremely fast websites and applications. A cross-site scripting vulnerability exists in gatsby versions prior to 5.25.1 and 6.x prior to 6.3.2, which stems from a lack of cleanup of inputs a...

SQL Injection

webpa is vulnerable to sql injection. The vulnerability exists because the user provided inputs are not properly validated which allows an attacker to inject and execute malicious SQL queries...

CVE-2023-0013 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform

The ABAP Keyword Documentation of SAP NetWeaver Application Server - versions 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, for ABAP and ABAP Platform does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. On successful exploitation an...

Google Chrome 输入验证错误漏洞

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from an input validation error vulnerability that stems from insufficient validation of untrusted inputs in downloads, which can be exploited by remote attackers to bypass download restrictions via a crafted HT...

Arbitrary Code Injection

Tomcat Catalina is vulnerable to Arbitrary Code Injection. The vulnerability exists in the report function of JsonErrorReportValve.java due to improper escaping of inputs from JsonErrorReportValve which allows an attacker to inject invalid input values...

U.S. Dept Of Defense: XSS on ( █████████.gov ) Via URL path

An XSS vulnerability was discovered on a government website, allowing an attacker to execute malicious code on the victim's browser and steal their cookies, potentially leading to account takeover. The vulnerability was exploited by injecting a script into the URL path. The suggested mitigation i...

K000130469: node.js systeminformation vulnerability CVE-2021-21315

Security Advisory Description The System Information Library for Node.JS npm package "systeminformation" is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Proble...

WordPress plugin Cryptocurrency Widgets Pack SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...

go-saml 数据伪造问题漏洞

go-saml is a good enough SAML client library written in Go open-sourced by Robots and Pencils. A security vulnerability exists in go-saml. An attacker exploits the vulnerability to create inputs that cause hash conflicts based on control over the inputs...

CVE-2022-43595

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-43594

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-43595

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-43594

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...

CVE-2022-43595

Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted ImageOutput Objects can lead to multiple null pointer dereferences. An attacker can provide malicious multiple inputs to trigger these...