CVE-2021-22889

Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the statsBreakdown parameter of stats.php and possibly other scripts due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking...

Revive Adserver 跨站脚本漏洞

Revive Adserver is an open source ad server under the GNU General Public License license with an integrated banner management interface and a tracking system for collecting statistical information. A reflected cross-site scripting vulnerability exists in the statsBreakdown parameter in stats.php ...

grub2 缓冲区错误漏洞

grub2 is a Linux system boot program from the GNU community. A security vulnerability exists in versions of grub2 prior to 2.06. Setparamprefix in the menu presentation code performs length calculations based on the premise that it takes three characters to represent a single quote with a quotati...

grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

A flaw was found in grub2. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in th...

grub2: Heap out-of-bounds write due to miscalculation of space required for quoting

A flaw was found in grub2. Setparamprefix in the menu rendering code performs a length calculation on the assumption that expressing a quoted single quote will require 3 characters, while it actually requires 4 characters which allows an attacker to corrupt memory by one byte for each quote in th...

UBUNTU-CVE-2021-3148

An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.genthin command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py...

CVE-2021-3148

A flaw was found in salt. Command injection using the SaltAPI, is possible due to json.dumps escaping double quotes while leaving the single quotes untouched. The highest threat from this vulnerability is to data confidentiality and integrity...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS. This happens because no HTML escaping is being performed when processing quotes. This applies even when the :escapehtml option was being used in combination with :quote. Details Cross-site scripting or XSS is a...

Cross-Site Scripting (XSS)

redcarpet is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript code via quotes. This vulnerability exists even when .escapehtml option is applied...

DEBIAN-CVE-2020-26298

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escapehtml opti...

PT-2021-3541 · Redcarpet +1 · Redcarpet +1

Name of the Vulnerable Software and Affected Versions: Redcarpet versions prior to 3.5.1 Description: The issue is related to incorrect input sanitization in the Redcarpet library, which can enable a cross-site scripting attack. This is due to the lack of HTML escaping when processing quotes, eve...

NCH Express Invoice Cross-Site Scripting Vulnerability

NCH Express Invoice is invoice software that allows you to create print-ready invoices that can be emailed or faxed to your customers for faster payment. A reflected cross-site scripting vulnerability exists in the Quotes List module in NCH Express Invoice 8.06-8.24. No detailed vulnerability...

CVE-2020-13476

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module...

CVE-2020-13476

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module...

Cross site scripting

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module...

CVE-2020-13476

NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module...

CVE-2020-13476

The CVE-2020-13476 entry describes a Reflected XSS in the Quotes List module of NCH Express Invoice versions 8.06–8.24. Affected software is the NCH Express Invoice product (Invoice software). According to the NVD entry, the vulnerability is network-accessible with MEDIUM overall risk (CVSS v3.1 ...

NCH Express Invoice 跨站脚本漏洞

NCH Express Invoice is invoice software that allows you to create print-ready invoices that can be emailed or faxed to your customers for faster payment. A reflected cross-site scripting vulnerability exists in the Quotes List module in NCH Express Invoice 8.06-8.24. No detailed vulnerability...

Command Injection

Overview systeminformation is a simple system and OS information library. Affected versions of this package are vulnerable to Command Injection. The sanitizeShellString function does not sanitize quotation marks, which could be leveraged by an attacker to execute arbitrary commands. PoC const si ...

CVE-2020-28347

tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slavemac parameter. NOTE: this issue exists because of an incomplete fix for CVE-2020-10882 in which shell quotes are mishandled...