3147 matches found
CVE-2021-38681: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center, pending a security pat...
CVE-2021-38681
A reflected cross-site scripting XSS vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center, pending a security pat...
CVE-2021-43551
CVE-2021-43551 affects OSIsoft PI Vision. A remote attacker with write access can inject code into a display (cross‑site scripting), potentially causing information disclosure, modification, or deletion when a victim loads/interacts with the infected display in Internet Explorer. PI Vision prior ...
CVE-2021-43551: Improper Neutralization of Input During Web Page Generation
A remote attacker with write access to PI Vision could inject code into a display. Unauthorized information disclosure, modification, or deletion is possible if a victim views or interacts with the infected display using Microsoft Internet Explorer. The impact affects PI System data and other dat...
PT-2021-23866
Name of the Vulnerable Software and Affected Versions PI Vision affected versions not specified Description A remote attacker with write access to PI Vision could inject code into a display, potentially leading to unauthorized information disclosure, modification, or deletion. This could occur if...
CVE-2021-41269 Unauthenticated remote code injection in cron-utils
cron-utils is a Java library to define, parse, validate, migrate crons as well as get human readable descriptions for them. In affected versions A template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code...
CVE-2021-34357
A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 2021/08/25 and...
CVE-2021-34357
CVE-2021-34357 describes a cross-site scripting (XSS) vulnerability affecting QNAP devices running QmailAgent. The issue allows remote attackers to inject malicious code via the affected QmailAgent component, with exploitation potentially leading to user impact on affected pages. The vulnerabilit...
CVE-2021-34357: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 2021/08/25 and...
CVE-2021-34357
A cross-site scripting XSS vulnerability has been reported to affect QNAP device running QmailAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QmailAgent: QmailAgent 3.0.2 2021/08/25 and...
The vulnerability of theEncode.pm module in the Perl programming language allows attackers to inject arbitrary code and gain elevated privileges.
The vulnerability of theEncode.pm module in the Perl programming language is related to incorrect handling of the search path. Exploiting this vulnerability allows a remote attacker to inject arbitrary code and gain increased privileges...
CVE-2021-43281
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed o...
Code injection
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed o...
CVE-2021-43281
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed o...
CVE-2021-43281
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed o...
CVE-2021-43281
MyBB prior to 1.8.29 is vulnerable to Remote Code Injection via the Admin CP Settings module. The issue arises because the Settings management code does not validate setting types on insert/update, allowing an admin with the Can manage settings? permission to inject PHP code through a setting of ...
CVE-2021-43281: Improper Control of Generation of Code
MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed o...
CVE-2021-20807
The CVE-2021-20807 issue is a cross-site scripting vulnerability in the Cybozu Remote Service management screen (versions 3.0.0–3.1.9). The underlying flaw enables an attacker to inject arbitrary scripts via unspecified vectors, potentially affecting users authenticated to the product and execute...
Security Bulletin: A vulnerability in IBM WebSphere Application Server affects IBM Spectrum Scale packaged in IBM Elastic Storage Server (CVE-2020-5258)
Summary There is a vulnerability in IBM WebSphere Application Server, used by IBM ESS, which could allow a remote attacker to inject arbitrary code in the system. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system...