3665 matches found
CVE-2024-39842
A SQL injection vulnerability in Centreon 24.04.2 allows a remote high-privileged attacker to execute arbitrary SQL command via user massive changes inputs...
CVE-2024-31414
The Eaton Foreseer software provides users the capability to customize the dashboard in WebView pages. However, the input fields for this feature in the Eaton Foreseer software lacked proper input sanitization on the server-side, which could lead to injection and execution of malicious scripts wh...
PT-2024-24056 · Eaton · Eaton Foreseer
Name of the Vulnerable Software and Affected Versions: Eaton Foreseer software affected versions not specified Description: The issue concerns the Eaton Foreseer software, which allows users to customize the dashboard in WebView pages. However, the input fields for this feature lack proper input...
GHSA-M6FV-JMCG-4JFG send vulnerable to template injection that can lead to XSS
Impact passing untrusted user input - even after sanitizing it - to SendStream.redirect may execute untrusted code Patches this issue is patched in send 0.19.0 Workarounds users are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any...
CVE-2024-45280
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...
CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...
CVE-2024-45280
SAP NetWeaver AS Java is affected by a Cross-Site Scripting (XSS) vulnerability in the login application caused by insufficient encoding of user-controlled inputs. The issue is exploitable over the network with user interaction required, and has limited impact on confidentiality and integrity (no...
CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability...
CVE-2024-42378 Cross-Site Scripting (XSS) in eProcurement on S/4HANA
Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor...
CVE-2024-42378 Cross-Site Scripting (XSS) in eProcurement on S/4HANA
Due to weak encoding of user-controlled inputs, eProcurement on SAP S/4HANA allows malicious scripts to be executed in the application, potentially leading to a Reflected Cross-Site Scripting XSS vulnerability. This has no impact on the availability of the application, but it can have some minor...
Fedora 39 : python-django4.2 (2024-28892f7c8f)
The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-28892f7c8f advisory. urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Tenable has extract...
python-django: Potential denial-of-service vulnerability in django.utils.html.urlize() and AdminURLFieldWidget
A flaw was found in Django. 'urlize', 'urlizetrunc', and 'AdminURLFieldWidget' may be subject to a denial of service attack via certain inputs with a very large number of Unicode characters...
python-django: Potential denial-of-service vulnerability in django.utils.html.urlize()
A flaw was found in Django. Processing very large inputs with a specific sequence of characters with the urlize and urlizetrunc functions can cause a denial of service...
python-django: Potential denial-of-service in django.utils.translation.get_supported_language_variant()
A vulnerability was found in Python-Django in the getsupportedlanguagevariant function. The issue triggers when parsed with very long strings, including a specific set of characters, leading to a potential denial of service attack...
UBUNTU-CVE-2024-45230
An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16. The urlize and urlizetrunc template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters...
Hitachi Energy MicroSCADA X SYS600 SQL注入漏洞
Hitachi Energy MicroSCADA X SYS600 is a SCADA product from Hitachi, Japan. It ensures optimal control and reliable operation of your switching station through seamless integration and connectivity between different devices and systems. A SQL injection vulnerability exists in Hitachi Energy...
PT-2024-30205 · Unknown · Itsourcecode Online Accreditation Management System
Name of the Vulnerable Software and Affected Versions: itsourcecode Online Accreditation Management System affected versions not specified Description: The itsourcecode Online Accreditation Management System contains a Cross Site Scripting issue, allowing an attacker to execute arbitrary code via...
CVE-2024-40886
Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...
CVE-2024-40886 One-click Client-Side Path Traversal Leading to CSRF in User Management admin page
Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in User Management page of the system console...