6015 matches found
Cross-site Scripting (XSS)
express-sanitize-escape is vulnerable to cross-site scripting XSS. The vulnerability exists as it doesn't sanitize the 'req.query' and 'req.body' since the 'req.param' has not been populated at the time that middleware is called allowing an attacker to inject arbitrary Javascript to cause a...
U.S. Dept Of Defense: Reflected XSS on https://███████/
Summary: Hey Team, There is reflected xss on https://█████/kinetic/ when certain action results in 404 error. Description: I am using some random strings paths after kinetic in https://███████/kinetic/ if that path is not exist then it says 404 not found. Strings is not sanitized after kinetic/ d...
HTML Injection
Overview All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgra...
WordPress Tutor 1.5.3 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications - Tile: Wordpress Plugin tutor.1.5.3 - Cross-Site Scripting - Author: mehran feizi - Category: webapps =================================================================== Vulnerable page: /Quiz.php...
WordPress Tutor 1.5.3 Cross Site Scripting
Tile: Wordpress Plugin tutor.1.5.3 - Cross-Site Scripting - Author: mehran feizi - Category: webapps - Date: 2020.02.12 =================================================================== Vulnerable page: /Quiz.php =================================================================== Vulnerable...
Command Injection
Overview All versions of traceroute are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The trace function is vulnerable and can be abused if the host value is controlle...
PT-2020-20145 · Trend Micro · Ossec-Hids
Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The issue arises from the OS CleanMSG function in ossec-analysisd, which fails to remove or encode terminal control characters or newlines from processed log messages. This can lead to the...
CVE-2020-5225
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances,...
CVE-2016-1000237
sanitize-html before 1.4.3 has XSS...
CVE-2016-1000237
sanitize-html before 1.4.3 has XSS...
Cross site scripting
sanitize-html before 1.4.3 has XSS...
CVE-2016-1000237
CVE-2016-1000237 affects sanitize-html prior to 1.4.3, where input is not sanitized recursively which may allow XSS. Documented in multiple sources (Node.js advisory GHSA-3J7M-HMH3-9JMP, Red Hat, Debian, NVD/NVD list). Impact is cross-site scripting via vulnerable sanitize-html versions; exploita...
CVE-2016-1000237
sanitize-html before 1.4.3 has XSS...
CVE-2016-1000237
sanitize-html before 1.4.3 has XSS...
Information Disclosure
schema-inspector is vulnerable to information disclosure. The vulnerability exists as the sanitize and validate functions can be bypassed, causing object's prototype properties to be enumerable...
PT-2020-7942
Name of the Vulnerable Software and Affected Versions: sanitize-html versions prior to 1.4.3 Description: The issue allows an attacker to execute arbitrary Javascript due to the lack of recursive sanitization of input in affected versions of sanitize-html. Recommendations: Update to version 1.4.3...
CVE-2019-10781
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector...
CVE-2019-10781
In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the sanitize and the validate function used within schema-inspector...