Advanced Admin Search < 1.1.6 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting. PoC Affected parameters: keyword, user, metaKey, and metaValue https://example.com/wp-admin/admin.php?page=advanced-admin-search="...

PT-2022-20424 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins vboxwrapper Plugin versions 1.3 and earlier Description: The Jenkins vboxwrapper Plugin does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting XSS...

Bestbooks <= 2.6.3 - Unauthenticated SQLi

The plugin does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users Affected parameters: credit and debit curl https://example.com/wp-admin/admin-ajax.php \ --data...

IBM Security Identity Governance and Intelligence 信息泄露漏洞

IBM Security Identity Governance and Intelligence IGI is a suite of identity governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. IBM Security Identity Governance and Intelligence version...

Covid-19 Travel Pass Management System SQL Injection Vulnerability (CNVD-2022-40237)

Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. It provides an online platform for individuals to submit travel passes within the Covid-19 restrictions. The Covid-19 Travel Pass Management System suffers from an SQL injection vulnerability that originates in...

PT-2022-20423 · Jenkins · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins Selection tasks Plugin versions 1.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability, which is exploitable by attackers with Item/Configure permission. This occurs because the plugin does n...

Covid-19 Travel Pass Management System SQL Injection Vulnerability

Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. It provides an online platform for individuals to submit travel passes within the Covid-19 restrictions. The Covid-19 Travel Pass Management System suffers from an SQL injection vulnerability that originates in...

Covid-19 Travel Pass Management System SQL Injection Vulnerability (CNVD-2022-85125)

Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. A SQL injection vulnerability exists in Covid-19 Travel Pass Management System v1.0, which originates from /ctpms/admin/individuals/updatestatus.php?id=Lack of filtering and escaping for parameters, which can be...

CVE-2022-30012

In the POST request of the appointment.php page of HMS v.0, there are SQL injection vulnerabilities in multiple parameters, and database information can be obtained through injection...

WordPress plugin WPC Smart Wishlist for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WPC Smart Wishlist for WooCommerces plugin versions prior to 2.9.9 contain a cross-site...

Buffer Overflows

linux is vulnerable to buffer overflows. st21nfcaconnectivityeventreceived in drivers/nfc/st21nfca/se.c has EVTTRANSACTION buffer overflows because of untrusted length parameters...

Jenkins allows Remote Users to Inject Build Parameters

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...

GHSA-QF2H-H3XQ-J93J Jenkins allows Remote Users to Inject Build Parameters

Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables...

GHSA-57WJ-22W9-WM9R Dolibarr SQL injection vulnerability

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes...

Dolibarr SQL injection vulnerability

SQL injection vulnerability in Dolibarr before 7.0.2 allows remote attackers to execute arbitrary SQL commands via vectors involving integer parameters without quotes...

Improper Neutralization of Input During Web Page Generation in JAMon

Multiple cross-site scripting XSS vulnerabilities in JAMon Java Application Monitor 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 listenertype or 2 currentlistener parameter to mondetail.jsp or ArraySQL parameter to 3 mondetail.jsp, 4 jamonadmin.jsp, 5...

Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via multiple parameters such as setName, webappType, httpPort, dsName, description, phase, and url in different JSP pages. An attacker can inject arbitrary web script or HTML by sending crafted input to these...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via multiple parameters such as setName, webappType, httpPort, dsName, description, phase, and url in different JSP pages. An attacker can inject arbitrary web script or HTML by sending crafted input to these...

GHSA-2VCM-2MCR-WMX7 WSO2 Carbon vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 setName parameter to identity-mgt/challenges-mgt.jsp; the 2 webappType or 3 httpPort parameter to webapp-list/webappinfo.jsp; the 4 dsName or 5 descriptio...