3985 matches found
GHSA-Q693-V7QF-P4XJ Alkacon OpenCMS CSV Injection via New User module
Alkacon OpenCMS v10.5.4 and before is affected by CSV aka Excel Macro Injection in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp via the First Name or Last Name...
CVE-2022-29005
Multiple cross-site scripting XSS vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters...
PT-2022-19359 · Unknown · Online Birth Certificate System
Name of the Vulnerable Software and Affected Versions: Online Birth Certificate System version 1.2 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters in the /obcs/user/profile.php component. This enabl...
Online Birth Certificate System 跨站脚本漏洞
Online Birth Certificate System is an online birth certificate system by the individual developer ANUJ KUMAR. A security vulnerability exists in Online Birth Certificate System version v1.2, which stems from multiple cross-site scripting XSS issues in the component /obcs/user/profile.php. An...
ToolJet 跨站脚本漏洞
A code injection vulnerability exists in ToolJet v0.6.0 through v1.10.2, which stems from a lack of data validation filtering of user-supplied data and output in the first and last name fields of the invitation email. An attacker could exploit this vulnerability to inject malicious code when...
CVE-2022-23068
ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail...
The publify application allows large characters to insert in the input field "First name and Last name" on the profile field which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request in publify / publify
Description The publify application allows large characters to insert in the input field "First name and Last name" which can allow attackers to cause a Denial of Service DoS via a crafted HTTP request Proof of Concept 1 - go to your profile https://demo-publify.herokuapp.com/admin/profiles 2 -...
Snipe-IT XSS Vulnerability
Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...
GHSA-FX98-8W93-4MXR Snipe-IT XSS Vulnerability
Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...
GHSA-2PP9-R4RV-6P6J Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the most recent installation/upgrade...
Fedora: Security Advisory for java-1.8.0-openjdk-aarch32 (FEDORA-2022-efaa7e8775)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
wee_alloc is Unmaintained
Two of the maintainers have indicated that the crate may not be maintained. The crate has open issues including memory leaks and may not be suitable for production use. It may be best to switch to the default Rust standard allocator on wasm32 targets. Last release seems to have been three years...
RUSTSEC-2022-0054 wee_alloc is Unmaintained
Two of the maintainers have indicated that the crate may not be maintained. The crate has open issues including memory leaks and may not be suitable for production use. It may be best to switch to the default Rust standard allocator on wasm32 targets. Last release seems to have been three years...
A new secret stash for “fileless” malware
In February 2022 we observed the technique of putting the shellcode into Windows event logs for the first time "in the wild" during the malicious campaign. It allows the "fileless" last stage Trojan to be hidden from plain sight in the file system. Such attention to the event logs in the campaign...
CVE-2021-34589
In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface...
CVE-2021-34589
In Bender/ebee Charge Controllers in multiple versions are prone to an RFID leak. The RFID of the last charge event can be read without authentication via the web interface...
CVE-2022-1054
The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and emai...
The vulnerability of the Simatic programmable logic controller’s software lies in the improper release of memory before deleting the last reference, allowing a intruder to trigger a service failure.
The vulnerability of the Simatic programmable logic controller’s software is related to the improper release of memory before deleting the last references. Exploiting this vulnerability can allow an attacker, operating remotely, to cause service failures...
CVE-2021-42869
A Cross Site Scripting XSS vulnerability exists in Chikista Patient Management Software 2.0.2 via the lastname parameter in the 1 patient/insert, 2 patientreport, 3 /appointmentreport, 4 visitreport, and 5 /billdetailreport pages...
CVE-2021-42869
A Cross Site Scripting XSS vulnerability exists in Chikista Patient Management Software 2.0.2 via the lastname parameter in the 1 patient/insert, 2 patientreport, 3 /appointmentreport, 4 visitreport, and 5 /billdetailreport pages...