CVE-2023-22853

Tiki before 24.1, when featurecreatewebhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval...

CVE-2023-22853

Tiki before 24.1, when featurecreatewebhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval...

Sql injection

UNSUPPORTED WHEN ASSIGNED A vulnerability was found in peel filebroker and classified as critical. Affected by this issue is the function selecttransferstatusdesc of the file lib/common.rb. The manipulation leads to sql injection. The name of the patch is 91097e26a6c84d3208a351afaa52e0f62e5853ef...

CVE-2020-36644

Inline SVG by jamesmartin is affected up to version 1.7.1. The vulnerability resides in the URL Parameter Handler, specifically lib/inline_svg/action_view/helpers.rb, where manipulating the filename argument can trigger cross-site scripting. It can be exploited remotely. Upgrading to version 1.7....

Node v18.13.0 (LTS)

Node v18.13.0 LTS By Danielle Adams, Jan 06, 2023 Notable changes Add support for externally shared js builtins By default Node.js is built so that all dependencies are bundled into the Node.js binary itself. Some Node.js distributions prefer to manage dependencies externally. There are existing...

Sql injection

A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. T...

CVE-2015-10014 arekk uke finder.rb sql injection

A vulnerability classified as critical has been found in arekk uke. This affects an unknown part of the file lib/uke/finder.rb. The manipulation leads to sql injection. The identifier of the patch is 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f. It is recommended to apply a patch to fix this issue. T...

CVE-2015-10014

CVE-2015-10014 affects arekk uke, specifically lib/uke/finder.rb, with a SQL injection vulnerability due to manipulation of that component. A patch is referenced: 52fd3b2d0bc16227ef57b7b98a3658bb67c1833f, and VDB-217485 is associated. Connected sources confirm the issue and patch, but no exploits...

Uke SQL注入漏洞

Uke is a database of Uke licenses by the individual developer Arkadiusz Kuryłowicz. A SQL injection vulnerability exists in uke, which stems from a problem in an unknown section of the file lib/uke/finder.rb that can lead to sql injection...

GHSA-PFRM-4RJW-G9Q5 string-kit Inefficient Regular Expression Complexity vulnerability

A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to versi...

string-kit Inefficient Regular Expression Complexity vulnerability

A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to versi...

CVE-2021-4299

A vulnerability classified as problematic was found in cronvel string-kit up to 0.12.7. This vulnerability affects the function naturalSort of the file lib/naturalSort.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. Upgrading to versi...

CVE-2017-20160

A vulnerability was found in flitto express-param up to 0.x. It has been classified as critical. This affects an unknown part of the file lib/fetchParams.js. The manipulation leads to improper handling of extra parameters. It is possible to initiate the attack remotely. Upgrading to version 1.0.0...

CVE-2017-20159

A vulnerability was found in rf Keynote up to 0.x on Rails. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lib/keynote/rumble.rb. The manipulation of the argument value leads to cross site scripting. The attack may be launched remotely. Upgradin...

Debian dla-3257 : emacs - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3257 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3257-1 [email protected] https://www.debian.org/lts/security/...

Authenticated HTMLi via theme parameter on /lib/ajax.php

Description The theme parameter is vulnerable to HTMLi on /lib/ajax.php endpoint Proof of Concept - go to https://v2.demo.froxlor.org - Login with a user - Go to https://v2.demo.froxlor.org/lib/ajax.php?action=newsfeed&theme=%3C/br%3E%3Ch1%3EHTMLi%20by%20leorac%3C/h1%3E%3Cbr%3E - You'll see the...

Malicious code in rmgjs-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13b895694dae89110a5e80c7137a8ccf64017169fe486b836eb5157c7b3f5ecd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bcashjs-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43f17b42835fc6b1885e7f354fcfc94bbb64f66f97e8b1ed5cb2940a07b54051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5823 Malicious code in rmgjs-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13b895694dae89110a5e80c7137a8ccf64017169fe486b836eb5157c7b3f5ecd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1478 Malicious code in bcashjs-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43f17b42835fc6b1885e7f354fcfc94bbb64f66f97e8b1ed5cb2940a07b54051 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...