8901 matches found
CVE-2021-3904
grav is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Grav 跨站脚本漏洞
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product presentations. A cross-site scripting vulnerability exists in grav, which stems from the vulnerability of grav to incorrect input neutralization "cross-site scripting"...
Cross-site Scripting in snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Delta Electronics DIALink
1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: DIALink Vulnerabilities: Cleartext Transmission of Sensitive Information, Cross-site Scripting, Improper Neutralization of Formula Elements in a CSV File, Cleartext Storage...
The vulnerability of the QNAP QVR surveillance system, related to the failure to take measures to neutralize special elements used in the operating system’s command line, allows a intruder to execute arbitrary code.
The vulnerability of the QNAP QVR video surveillance system is related to the failure to take measures to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Cross site scripting
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2021-3863
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2021-29679
IBM Cognos Analytics 11.1.7 and 11.2.0 could allow an authenticated user to execute code remotely due to incorrectly neutralizaing user-contrlled input that could be interpreted a a server-side include SSI directive. IBM X-Force ID: 199915...
IBM Cognos Analytics 代码注入漏洞
A remote code execution vulnerability exists in IBM Cognos Analytics version 11.1.7, 11.2.0, a suite of business intelligence software from IBM Corporation that provides valuable information, secure data governance, and reporting. The vulnerability stems from incorrect neutralization of...
CVE-2021-36175
An improper neutralization of input vulnerability CWE-79 in FortiWebManager versions 6.2.3 and below, 6.0.2 and below may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device...
CVE-2021-24021
An improper neutralization of input vulnerability CWE-79 in FortiAnalyzer versions 6.4.3 and below, 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack XSS via the column settings of Logview in FortiAnalyzer, should the...
CVE-2021-24021
Fortinet FortiAnalyzer contains an input handling flaw (CWE-79) that enables a stored XSS via the Logview column settings. A remote authenticated attacker who can obtain the relevant POST request could trigger the vulnerability. Affected versions are 6.4.3 and below, 6.2.7 and below, and 6.0.10 a...
CVE-2021-36175
FortiWebManager (Fortinet) is affected by CVE-2021-36175. The issue is an input handling flaw (CWE-79) that could allow an authenticated remote attacker to inject malicious script/tags through the name, description, or comments fields in several sections of FortiWebManager. Affected versions are ...
FortiWebManager - Injection vulnerabilities
An improper neutralization of input vulnerability CWE-79 in FortiWebManager may allow a remote authenticated attacker to inject malicious script/tags via the name/description/comments parameter of various sections of the device...
CVE-2021-24016
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...
Input validation
An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...
CVE-2021-24016
Fortinet FortiManager vulnerability CVE-2021-24016: An improper neutralization of formula elements in policy-name CSV/Excel fields can lead to arbitrary shell commands when a crafted IPv4 field is included and the exported configuration file is opened unsafely. Affected are FortiManager 6.4.3 and...
btcpay server 跨站脚本漏洞
btcpay server is a free and open source bitcoin payment processor that allows you to accept bitcoins without fees or intermediaries. A cross-site scripting vulnerability exists in btcpay server. The vulnerability stems from the susceptibility to incorrect input neutralization "cross-site scriptin...
CVE-2021-36823
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Cusmin AGCA - Absolutely Glamorous Custom Admin WordPress plugin allows Stored XSS.This issue affects AGCA - Absolutely Glamorous Custom Admin WordPress plugin: from n/a through 6.8...