6024 matches found
Cross-site Scripting (XSS)
Krayin CRM is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation in the organization name field in /admin/contacts/organizations/edit/2, allowing malicious scripts to be injected...
CVE-2023-37154
checkbyssh in Nagios nagios-plugins 2.4.5 allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with $IFS. This has been categorized both as fixed in e8810de, and as intended behavior...
CVE-2023-45359
CVE-2023-45359 affects MediaWiki’s Vector Skin: vector-toc-toggle-button-label is not escaped, allowing markup in the line parameter. Affected: Vector Skin for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. Descriptions in connected docs do not provide exploitation details or a confirmed patch...
CVE-2023-37154
CVE-2023-37154 affects Nagios nagios-plugins 2.4.5, where check_by_ssh allows arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with ${IFS}. The issue is noted as categorized both as fixed in commit e8810de and as intended behavior; exploitation details are not pr...
CVE-2023-36325
CVE-2023-36325 affects i2p before 2.3.0 (Java). A correlation attack during a tunneled, replayed message with a behavior discrepancy can de-anonymize the public IPv4 and IPv6 addresses of i2p hidden services (eepsites). Impact is de-anonymization; attack would take days to complete. Affected vers...
CVE-2023-45361
The CVE-2023-45361 issue affects MediaWiki’s Vector Skin (VectorComponentUserLinks.php) in versions prior to 1.39.5 and 1.40.x prior to 1.40.1. The root cause is that MalformedTitleException is uncaught when a vector-intro-page title is invalid, which can lead to incorrect web pages being produce...
CVE-2023-46586
The CVE affects the Weborf web server implementation (cgi.c) prior to version 1.0. The root cause is a misused strncpy that fails to terminate CGI script paths with a null character, leaving input paths unterminated. This impacts Weborf releases before 1.0 across reported versions (0.17–0.20). Pr...
Cross-site Scripting (XSS)
Overview krayin/laravel-crm is a hand tailored CRM framework built on some of the hottest opensource technologies such as Laravel a PHP framework and Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the organization name...
GHSA-74Q2-6JP4-3RQQ Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting XSS via the organization name field in /admin/contacts/organizations/edit/2...
CVE-2024-45932
Krayin CRM v1.3.0 is affected by a Cross-Site Scripting (XSS) vulnerability in the organization name field of /admin/contacts/organizations/edit/2. The issue is caused by improper input validation/escaping, allowing attacker-supplied scripts to be reflected to users. Documentation from multiple s...
Esri Portal For ArcGIS 安全漏洞
Esri Portal For ArcGIS is a component of esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. An information disclosure vulnerability exists in Esri Portal for ArcGIS, which can be exploited by attackers to obtain sensitive...
Malicious Package
Overview buy-sell-opensea-sdk-demo is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection...
Malicious Package
Overview language-rego is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between that...
Malicious Package
Overview sdk-integration-tests is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection between...
Malicious Package
Overview agoda-design-toolkit-2 is a malicious package. This package contains malicious code that collects sensitive information about the victim and sends it to the attacker's remote server. While this package might be attempting to impersonate a valid organization, there is no connection betwee...