Cross site scripting

Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment...

CVE-2021-3026

CVE-2021-3026 affects Invision Community IPS Community Suite prior to 4.5.4.2 and enables cross-site scripting during the quoting of a post or comment. The issue is described as XSS in the quoting workflow, with multiple external records corroborating the vulnerability. The provided documents do ...

CVE-2021-3026: Improper Neutralization of Input During Web Page Generation

Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment...

SUSE-SU-2020:3089-1 Security update for pacemaker

This update for pacemaker fixes the following issues: - attrd: handle shutdown more cleanly bsc1173668 - executor: restrict certain IPC requests to Pacemaker daemons CVE-2020-25654, bsc1177916 - extra: quote shell variables in agent code where appropriate bsc1175557 - fencer: restrict certain IPC...

SUSE-SU-2020:3086-1 Security update for pacemaker

This update for pacemaker fixes the following issues: - attrd: handle shutdown more cleanly bsc1173668 - executor: restrict certain IPC requests to Pacemaker daemons CVE-2020-25654, bsc1177916 - extra: quote shell variables in agent code where appropriate bsc1175557 - fencer: restrict certain IPC...

The vulnerability of the Courseware component of the customer interaction application of Oracle Quoting allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Courseware component of the Oracle Quoting application lies in its lack of access control mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information via the HTTP network protocol...

CVE-2020-2833

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks...

CVE-2020-2833

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks...

Buffer overflow

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks...

CVE-2020-2833

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks...

CVE-2020-2833

CVE-2020-2833 affects Oracle Quoting in Oracle E-Business Suite (Courseware) for 12.1.1–12.1.3. The vulnerability is exploitable over HTTP with network access and unauthenticated access, requiring user interaction for exploitation. Impact includes unauthorized data access and potential data manip...

CVE-2020-2833: Undefined Security Weakness

Vulnerability in the Oracle Quoting product of Oracle E-Business Suite component: Courseware. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Quoting. Successful attacks...

SQL Injection

Products.Pythonscripts is vulnerable to SQL injection. The vulnerability exists as there was insufficient SQL quoting in DTML or in connection objects, allowing \x00, ', ", \\, to be used to inject arbitrary SQL statements...

Debian: Security Advisory (DLA-1864-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 1864-1] patch security update

Package : patch Version : 2.7.5-1+deb8u3 CVE ID : CVE-2019-13638 An issue with quoting has been found in patch, a tool to apply a diff file to an original, when invoking ed. In order to avoid this, ed is now directly started instead of calling a shell which starts ed. For Debian 8 "Jessie", this...

CVE-2019-8459

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one...

PT-2019-12716 · Otrs +2 · Otrs +3

Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 7.0.x through 7.0.7 Open Ticket Request System OTRS Community Edition versions 6.0.x through 6.0.19 Open Ticket Request System OTRS Community Edition versions 5.0.x through 5.0.36 Description: An issue...

Vanilla: Hidden Stored XSS in nested post embeds

Summary: Comments can be crafted in a way that when quoted will trigger a hidden stored XSS payload. Requires initial user interaction. Description: When quoting a comment, an attacker can edit the insert embed-external data url field to contain a string which when parsed, can result in the...

SQL Command Injection By Leveraging Improper Range Quoting

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting...

SQL Command Injection By Leveraging Improper Bitstring Quoting

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting...