161 matches found
CVE-2022-25907 Prototype Pollution
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...
CVE-2022-25907 Prototype Pollution
The package ts-deepmerge before 2.0.2 are vulnerable to Prototype Pollution due to missing sanitization of the merge function...
PT-2022-13871 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0.2 through 14.8.6 GitLab CE/EE versions 14.9.0 through 14.9.4 GitLab CE/EE versions 14.10.0 through 14.10.1 Description: The issue is related to missing sanitization of data in Pipeline error messages, allowing for th...
CVE-2022-0625
The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...
PT-2022-13679 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 14.7.7 GitLab CE/EE version 14.8 prior to 14.8.5 GitLab CE/EE version 14.9 prior to 14.9.2 Description: The issue is related to missing sanitization of logged exception messages in GitLab CE/EE, which can cause...
CVE-2022-0889 Ninja Forms - File Uploads Extension <= 3.3.12 - Reflected Cross-Site Scripting
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the /includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web script...
Code injection in npm git
All versions of package git are vulnerable to Remote Code Execution RCE due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released...
CVE-2021-23632: Improper Neutralization of Special Elements used in an OS Command
All versions of package git are vulnerable to Remote Code Execution RCE due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git =...
CVE-2021-23558 Prototype Pollution
The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in CVE-2020-7736...
CVE-2021-23558: Improperly Controlled Modification of Object Prototype Attributes
The package bmoor before 0.10.1 are vulnerable to Prototype Pollution due to missing sanitization in set function. Note: This vulnerability derives from an incomplete fix in CVE-2020-7736...
Server side request forgery (ssrf)
The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...
CVE-2021-23664: Server-Side Request Forgery (SSRF)
The package @isomorphic-git/cors-proxy before 2.7.1 are vulnerable to Server-side Request Forgery SSRF due to missing sanitization and validation of the redirection action in middleware.js...
PT-2021-16313 · WordPress · Stylish Cost Calculator
Name of the Vulnerable Software and Affected Versions: Stylish Cost Calculator WordPress plugin versions prior to 7.0.4 Description: The issue is related to the lack of authorization and CSRF checks on some AJAX actions in the plugin, which are available to authenticated users. This could allow a...
GHSA-HQV3-QQ72-78CV Directory Traversal in startserver
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...
Directory Traversal in startserver
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...
CVE-2021-23430
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...
CVE-2021-23430
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...
Directory traversal
All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization...