Improper sanitization of Transfer-Encoding headers in net/http

...

CVE-2022-24278

The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file...

PT-2022-2516 · D Link · D-Link Dir-823-Pro

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823-Pro version 1.0.2 Description: The issue is related to the implementation of the SetNTPserverSeting function in the D-Link DIR-823-Pro wireless router's firmware, which fails to properly sanitize data at the management level...

CVE-2021-38450

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software...

CVE-2021-41149 Improper sanitization of target names in tough

Tough provides a set of Rust libraries and tools for using and generating the update framework TUF repositories. The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached o...

CVE-2021-24416

The StreamCast – Radio Player for WordPress plugin before 2.1.1 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode...

CVE-2021-22910

A sanitization vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE...

CVE-2021-22910

A sanitization vulnerability exists in Rocket.Chat server versions 3.13.2, 3.12.4, 3.11.4 that allowed queries to an endpoint which could result in a NoSQL injection, potentially leading to RCE...

CVE-2021-22910

CVE-2021-22910 affects Rocket.Chat server versions prior to 3.13.2, 3.12.4, and 3.11.4. The vulnerability is a sanitization issue in certain endpoints that allows crafted queries to trigger a NoSQL injection, potentially leading to remote code execution. Red Hat and OSV entries corroborate the sa...

WordPress GiveWP Plugin < 2.10.4 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-24247

CVE-2021-24247 relates to the WordPress plugin “Contact Form Check Tester” (up to version 1.0.2). The vulnerability arises because plugin settings are visible to all registered users in the dashboard and are not sanitized, allowing a user (e.g., a subscriber) to insert an XSS payload that can be ...

Cross-site Scripting (XSS)

gon is vulnerable to cross-site scripting XSS attacks. Lack of sanitization of malicious characters within the JSON data in jsondumper.rb allows a malicious user to inject and execute arbitrary javascript in a user's browser...

Cross-site Scripting (XSS)

semantic-ui-search is vulnerable to cross-site scripting XSS. The vulnerability exists through the lack of sanitization in several dropdown values in modules/dropdown.js...

CVE-2020-24316

WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

Input validation

Improper data sanitization vulnerability in subsystem in IntelR SPS before versions SPSE504.00.04.381.0, SPSE304.01.04.054.0, SPSSoC-A04.00.04.181.0, and SPSSoC-X04.00.04.086.0 may allow a privileged user to potentially enable escalation of privilege via local access...

Cross site scripting

Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting XSS vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an...

CVE-2018-8568

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft SharePoint Server, Microsoft...

MyBB Thank YouLike Plugin 3.0.0 - Cross-Site Scripting

MyBB Thank YouLike Plugin 3.0.0 - Cross-Site Scripting Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting Date: 8/1/2018 Author: 0xB9 Twitter: @0xB9Sec Contact: 0xB9atpm.me Software Link: https://community.mybb.com/mods.php?action=view&pid=360 Version: 3.0.0 Tested on: Ubuntu...

[ASA-201805-10] firefox: multiple issues

Arch Linux Security Advisory ASA-201805-10 ========================================== Severity: Critical Date : 2018-05-13 CVE-ID : CVE-2018-5150 CVE-2018-5151 CVE-2018-5152 CVE-2018-5153 CVE-2018-5154 CVE-2018-5155 CVE-2018-5157 CVE-2018-5158 CVE-2018-5159 CVE-2018-5160 CVE-2018-5163 CVE-2018-51...

Cross-site Scripting (XSS)

github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization in the username field of the user model...