EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2023-2243)

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a...

GHSA-GWXV-JV83-6QJR JStachio XSS vulnerability: Unescaped single quotes

Impact Description: JStachio fails to escape single quotes ' in HTML, allowing an attacker to inject malicious code. Reproduction Steps: Use the following template code: html Set the value variable to ' onblur='alert1. java public class Escaping public static void mainString args Model model = ne...

JStachio 跨站脚本漏洞

JStachio is a type-safe Java Mustache template engine. A security vulnerability exists in JStachio versions prior to 1.0.1, which stems from JStachio's inability to escape single quotes in HTML, and can be exploited by an attacker to inject malicious code...

PT-2023-24603 · Jstachio · Jstachio

Name of the Vulnerable Software and Affected Versions: JStachio versions prior to 1.0.1 Description: JStachio fails to escape single quotes ' in HTML, allowing an attacker to inject malicious code. This can be exploited to execute arbitrary JavaScript code in the context of other users visiting...

UBUNTU-CVE-2023-31669

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote "...

CVE-2023-31669

WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote "...

php: PDO:: quote() may return unquoted string due to an integer overflow

A flaw was found in PHP. This issue occurs due to an uncaught integer overflow in PDO::quote of PDOSQLite returning an improperly quoted string. With the implementation of sqlite3snprintf, it is possible to force the function to return a single apostrophe if the function is called on user-supplie...

PositionManager's moveLiquidity can freeze funds by removing destination index even when the move was partial

Lines of code Vulnerability details positionIndex.removeparams.fromIndexremoves the PositionManager entry even when it is only partial removal as a result of IPoolparams.pool.moveQuoteToken... call. I.e. it is correct to do fromPosition.lps -= vars.lpbAmountFrom, but the resulting amount might no...

The vulnerability of the ClusterEngine cluster management platform, related to the implementation or modification of arguments, allows a perpetrator to execute arbitrary code.

The vulnerability of the ClusterEngine cluster management platform is related to the implementation or modification of arguments with the "'" parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending specially crafted packets...

CVE-2022-25091

Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature...

CVE-2022-25091

Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature...

CVE-2022-25091: Incorrect Authorization

Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature...

OESA-2023-1245 nasm security update

NASM is the Netwide Assembler, a free portable assembler for the Intel 80x86 microprocessor series, using primarily the traditional Intel instruction mnemonics and syntax. It also provides tools in RDOFF binary format, includes linker, library manager, loader, and information dump. Security Fixes...

Vulnerability of the `quote_for_pmake()` function in the Netwide Assembler (NASM) assembler; this allows a hacker to execute arbitrary code.

The vulnerability of the quoteforpmake function asm/nasm.c in the Netwide Assembler NASM compiler is related to the execution of an operation outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2023-0983

The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form...

CVE-2023-0983

The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form...

Cross site scripting

The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form...

CVE-2023-0983 Stylish Cost Calculator Premium < 7.9.0 - Unauthenticated Stored XSS

The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form...

CVE-2023-0983

CVE-2023-0983 affects the WordPress plugin Stylish Cost Calculator Premium up to version 7.9.0. The vulnerability is an unauthenticated stored Cross-Site Scripting caused by insufficient sanitization/escaping of a parameter when outputting it on the Email Quote Form submission page, potentially e...

CVE-2023-0983 Stylish Cost Calculator Premium < 7.9.0 - Unauthenticated Stored XSS

The stylish-cost-calculator-premium WordPress plugin before 7.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Stored Cross-Site Scripting which could be used against admins when viewing submissions submitted through the Email Quote Form...