Cross site scripting

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1099, CVE-2020-1100, CVE-2020-1106...

CVE-2020-12696

The iframe plugin before 4.5 for WordPress does not sanitize a URL...

CVE-2020-12696

The iframe plugin before 4.5 for WordPress does not sanitize a URL...

Arbitrary Directory Access

salt allows arbitrary directory access. The salt-master process in ClearFuncs class allows access to some methods that improperly sanitize paths and the methods allow authenticated users to access arbitrary directories...

Node.js third-party modules: [flsaba] Stored XSS in the file and directory name when directories listing

I would like to report a Stored XSS in module "flsaba". It allows to inject malicious scripts in the file and directory name, store them on the server, then execute these scripts in the browser via the XSS vulnerability. Module module name: https://www.npmjs.com/package/flsaba version: 1.1.0 npm...

Security Updates for Microsoft Project Server (April 2020)

The Microsoft Project Server installation on the remote host is missing a security update. It is, therefore, affected by a cross-site-scripting XSS vulnerability. Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An...

apostrophe-tumblr (>=0.5.1, <=0.5.13), http-teapot-comment (0.1.0) +1 more potentially affected by CVE-2016-1000237 via sanitize-html (>=1.1.4, <=1.4.2)

sanitize-html NPM version =1.1.4, =0.5.1, =0.5.13 - http-teapot-comment 0.1.0 - piedpiper-middle-out 5.8.1 Source cves: CVE-2016-1000237 Source advisory: OSV:GHSA-3J7M-HMH3-9JMP...

GHSA-3J7M-HMH3-9JMP Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later...

Cross-Site Scripting in sanitize-html

Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later...

Command Injection

Overview All versions of umount are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the umount function . This may allow attackers to execute arbitrary code in the system if the device value passed to the function is...

Cross site scripting

A Cross-site Scripting XSS vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'...

Cross site scripting

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0893...

Microsoft SharePoint Reflective XSS Vulnerability

This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server. An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server. The attacker who...

Cross-site Scripting (XSS)

express-sanitize-escape is vulnerable to cross-site scripting XSS. The vulnerability exists as it doesn't sanitize the 'req.query' and 'req.body' since the 'req.param' has not been populated at the time that middleware is called allowing an attacker to inject arbitrary Javascript to cause a...

U.S. Dept Of Defense: Reflected XSS on https://███████/

Summary: Hey Team, There is reflected xss on https://█████/kinetic/ when certain action results in 404 error. Description: I am using some random strings paths after kinetic in https://███████/kinetic/ if that path is not exist then it says 404 not found. Strings is not sanitized after kinetic/ d...

HTML Injection

Overview All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgra...

WordPress Tutor 1.5.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications - Tile: Wordpress Plugin tutor.1.5.3 - Cross-Site Scripting - Author: mehran feizi - Category: webapps =================================================================== Vulnerable page: /Quiz.php...

WordPress Tutor 1.5.3 Cross Site Scripting

Tile: Wordpress Plugin tutor.1.5.3 - Cross-Site Scripting - Author: mehran feizi - Category: webapps - Date: 2020.02.12 =================================================================== Vulnerable page: /Quiz.php =================================================================== Vulnerable...

Command Injection

Overview All versions of traceroute are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The trace function is vulnerable and can be abused if the host value is controlle...

PT-2020-20145 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The issue arises from the OS CleanMSG function in ossec-analysisd, which fails to remove or encode terminal control characters or newlines from processed log messages. This can lead to the...