3059 matches found
CVE-2022-40238
CVE-2022-40238 describes a Remote Code Injection in CERT software prior to 1.50.5. An authenticated attacker can inject arbitrary pickle objects as part of a user’s profile, leading to code execution on the server when the profile is accessed. Affected component is CERT software’s profile handlin...
CVE-2022-40238 A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed...
CVE-2022-40238 A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed...
CVE-2022-40238 A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5
A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed...
PT-2022-25301 · Cert · Cert
Name of the Vulnerable Software and Affected Versions: CERT software versions prior to 1.50.5 Description: A Remote Code Injection issue exists, allowing an authenticated attacker to inject arbitrary pickle objects as part of a user's profile. This can lead to code execution on the server when th...
GHSA-X43W-XPHX-86W3 Liferay Portal Vulnerable to XSS in the Object Module
Cross-site scripting XSS vulnerability in the Object module's edit object details page in Liferay Object Web before 1.0.99 from Liferay Portal 7.4.3.4 through 7.4.3.36 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into the object field's Label text...
PT-2022-26262 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.3.2 through 7.4.3.16 Liferay DXP versions 7.3 before update 6, and 7.4 before update 17 Description: A Cross-site scripting XSS issue in the Frontend Taglib module allows remote attackers to inject arbitrary web scri...
CVE-2022-39220 XSS Vulnerabilities in WebClient
SFTPGo is an SFTP server written in Go. Versions prior to 2.3.5 are subject to Cross-site scripting XSS vulnerabilities in the SFTPGo WebClient, allowing remote attackers to inject malicious code. This issue is patched in version 2.3.5. No known workarounds exist...
ForkCMS XSS via `publish_on_time` parameter
A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the publishontime Parameter. This issue was patched in version 5.11.0...
CVE-2021-42750
CVE-2021-42750 is a stored XSS vulnerability in the ThingsBoard 3.3.1 Rule Engine that allows remote attackers with administrative access to inject JavaScript into the title of a rule node, which is executed in the editor when hovered. Multiple sources confirm the issue in ThingsBoard 3.3.1 and d...
CVE-2022-35589
A cross-site scripting XSS issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publishontime" Parameter...
Exploit for Code Injection in Vmware Spring_Cloud_Gateway
CVE-2022-22947 Introduction to CVE-2022-22947 The Spring C...
CVE-2022-30083
EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code remote...
CVE-2022-30083
EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code remote...
GHSA-5GXC-FXCR-9326 convert-svg-core vulnerable to remote code injection
The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an onload attribute. Puppeteer/Chromium used by convert-svg-core will execute any code within that tag, including malicious code. PoC Payload html where the id...
convert-svg-core vulnerable to remote code injection
The package convert-svg-core before 0.6.2 is vulnerable to Remote Code Injection via sending an SVG file containing the payload in an onload attribute. Puppeteer/Chromium used by convert-svg-core will execute any code within that tag, including malicious code. PoC Payload html where the id...
CVE-2022-25759
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload...
Code injection
The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload...
CVE-2022-25759
The CVE-2022-25759 issue affects the convert-svg-core npm package, specifically versions before 0.6.2. It enables remote code injection by processing an SVG containing a payload (notably via an onload attribute). Impact is remote code execution when using the vulnerable library in conjunction wit...