CVE-2022-39375: Improper Neutralization of Input During Web Page Generation

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicious code in dashboards of other users...

Arbitrary Code Execution

powerlinegitstatus is vulnerable to arbitrary code execution. The vulnerability is due to the getbasecommand function in segments.py with git repositories containing per-repository configurations that are being displayed when changing the directories which allows an attacker to inject and execute...

CVE-2022-39220

SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting XSS vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist...

CVE-2022-38625: Insufficient Verification of Data Authenticity

Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position i...

Denial Of Service (DoS)

firefox is vulnerable to remote code execution. The vulnerability exists due to a memory corruption allowing an attacker to inject maliciously crafted code into the system...

CVE-2022-21937: Improper Neutralization of Input During Web Page Generation

Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface...

PT-2022-10343

Name of the Vulnerable Software and Affected Versions QNAP Proxy Server versions prior to 1.4.2 QNAP Proxy Server versions prior to 1.4.3 in QuTS hero h5.0.0 QNAP Proxy Server versions prior to 1.4.2 in QuTScloud c4.5.6 Description A cross-site request forgery CSRF vulnerability has been reported...

CVE-2021-34360: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy...

Remote Code Execution (RCE)

formidable is vulnerable to remote code execution. The vulnerability exists due to the lack validation in the upload file, allowing an attacker to inject and execute malicious code via crafted filename...

CVE-2022-24881

Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but...

PT-2022-16954

Name of the Vulnerable Software and Affected Versions Ballcat Codegen versions prior to 1.0.0.beta.2 Description Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious...

Remote Code Execution (RCE)

jenkins-2-plugins is vulnerable to remote code execution. The vulnerability exists due to a sandbox bypass allowing an attacker to inject maliciously crafted code into the system...

PT-2022-10493

Name of the Vulnerable Software and Affected Versions Johnson Controls Metasys versions prior to 10.1.5 Johnson Controls Metasys versions prior to 11.0.2 Description A Server-Side Request Forgery SSRF issue in Johnson Controls Metasys could allow an authenticated attacker to inject malicious code...

CVE-2021-39908: Improper Control of Generation of Code

In all versions of GitLab CE/EE starting from 0.8.0 before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 certain Unicode characters can be abused to commit malicious code into projects without being noticed in merge request or source code...

Modern Events Calendar Lite < 6.4.7 - Reflected Cross-Site Scripting

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC On a page where the Total Booking widget is displayed, append the following payload: "...

CVE-2022-25612 WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in Simple Event Planner WordPress plugin = 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &customeventorganiser, &customorganiseremail, &customorganisercontact...

CVE-2022-24915 ICSA-22-062-01 IPCOMM ipDIO

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the web section where the information is displayed. Injection can be done on specific parameters. Th...

CVE-2022-22985 ICSA-22-062-01 IPCOMM ipDIO

The absence of filters when loading some sections in the web application of the vulnerable device allows attackers to inject malicious code that will be interpreted when a legitimate user accesses the specific web section where the information is displayed. Injection can be done on specific...

PT-2022-10342

Name of the Vulnerable Software and Affected Versions QNAP Proxy Server versions prior to 1.4.2 Description A cross-site scripting XSS vulnerability has been reported to affect QNAP devices running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code...

CVE-2021-34361: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect QNAP device running Proxy Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Proxy Server: QTS 4.5.x: Proxy Server 1.4...