gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.13.2: Prevent panic on fuzzer provided string Add secure/httpOnly attributes to the lang cookie...

Valeriangalliat Markdown It Highlightjs Cross-Site Scripting Vulnerability

Valeriangalliat Markdown It Highlightjs is Valeriangalliat individual developers of a Js code base for Web page Markdown highlighting . A cross-site scripting vulnerability exists in markdown-it-highlightjs versions prior to 3.3.1, which stems from the ability to insert malicious JavaScript as th...

CVE-2020-7773

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require"markdown-it-highlightjs"; const md = require'markdown-it'; const...

Cross-site Scripting (XSS)

Overview markdown-it-highlightjs is a Preset to use highlight.js with markdown-it. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const...

CMSuno Code Injection Vulnerability (CNVD-2020-63993)

CMSUno is an easy and handy tool for creating one-page responsive websites. A code injection vulnerability exists in CMSuno 1.6.2. This vulnerability can be exploited to inject malicious code into the "lang" parameter of /uno/central.php and run this PHP code in a web page to take over control of...

CVE-2020-5781

In IgniteNet HeliOS GLinq v2.2.1 r2961, the langSelection parameter is stored in the luci configuration file /etc/config/luci by the authenticator.htmlauth function. When modified with arbitrary javascript, this causes a denial-of-service condition for all other users...

Prototype Pollution

connie-lang is vulnerable to prototype pollution. The vulnerability exists as it does not restrict proto headers to be set in objects...

CVE-2020-7706

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie...

CVE-2020-7706

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie...

Code injection

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie...

CVE-2020-7706

The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie...

CVE-2020-7706

CVE-2020-7706: The connie-lang package before 0.1.1 is vulnerable to Prototype Pollution in its configuration language library. Affects connie-lang (node module) before 0.1.1. Root cause: prototype pollution in the library used by connie. Impact/summary: potential remote code execution or modific...

PT-2020-19729 · Connie Lang · Connie-Lang

Name of the Vulnerable Software and Affected Versions: connie-lang versions prior to 0.1.1 Description: The issue concerns Prototype Pollution in the configuration language library used by connie-lang. Recommendations: For versions prior to 0.1.1, update to version 0.1.1 or later to resolve the...

app-context-connie (>=0.0.1, <=1.1.0), app-context-connie-firebase (>=0.0.1, <=0.0.3) +1 more potentially affected by CVE-2020-7706 via connie-lang (>=0.0.1, <=0.1.0)

connie-lang NPM version =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.2.1 Source cves: CVE-2020-7706 Source advisory: SNYK:JS-CONNIELANG-598853...

CVE-2020-6171

A cross-site scripting XSS vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2020-6171

A cross-site scripting XSS vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

Cross site scripting

A cross-site scripting XSS vulnerability in the index page of the CLink Office 2.0 management console allows remote attackers to inject arbitrary web script or HTML via the lang parameter...

CVE-2020-6171

CVE-2020-6171 : CLink Office 2.0 management console index page is vulnerable to Cross‑Site Scripting via the lang parameter. Remote attackers can inject arbitrary script/HTML, with impact including potential data theft or session hijacking as described in connected sources. The CVSS shows MEDIUM ...

PHPKB Multi-Language 9 Authenticated Directory Traversal Exploit

Exploit for php platform in category web applications Exploit Title: PHPKB Multi-Language 9 - Authenticated Directory Traversal Exploit Author: Antonio Cannito Vendor Homepage: https://www.knowledgebase-script.com/ Software Link: https://www.knowledgebase-script.com/pricing.php Version:...

CVE-2020-8510

An issue was discovered in phpABook 0.9 Intermediate. On the login page, if one sets a userInfo cookie with the value of admin+1+en user+perms+lang, one can login as any user without a password...