625 matches found
Hardcoded credentials
It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be render...
CVE-2022-3895
Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML XSS...
Open Redirect
apacheairflow is vulnerable to open redirect. The vulnerability exists due to the getsafeurl function in views.py improperly sanitizing headers leading to open redirect in the webserver's /confirm endpoint...
PT-2022-23896 · Unknown · Crime Reporting System
Name of the Vulnerable Software and Affected Versions: Crime Reporting System version 1.0 Description: The issue allows a remote attacker to introduce arbitrary Javascript via manipulation of an unsanitized POST parameter, enabling persistent cross-site scripting XSS attacks. Recommendations: For...
WordPress Robo Gallery 3.2.1 plugin - Bypass POST comment approvement Vulnerability
Title: WordPress 6.0 - Bypass POST comment approvement Robo Gallery 3.2.1 Author: nu11secur1ty Vendor: https://wordpress.org/ Software: https://wordpress.org/plugins/robo-gallery/ Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/RoboGallery Description:...
GHSA-FCPW-VQH5-6QWJ Moodle reflected XSS Vulnerability
In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...
Moodle reflected XSS Vulnerability
In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...
CVE-2020-14320
In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk...
Moodle XSS Vulnerability
In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting...
GHSA-CWHP-RQFR-8462 Moodle XSS Vulnerability
In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting...
CVE-2020-1691
In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting...
Cross site scripting
In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting...
UBUNTU-CVE-2020-1691
In Moodle 3.8, messages required extra sanitizing before updating the conversation overview, to prevent the risk of stored cross-site scripting...
CVE-2020-1691
In Moodle 3.8, CVE-2020-1691 concerns insufficient sanitization of messages before updating the conversation overview, risking stored cross-site scripting. The affected component is Moodle’s messaging/conversation update flow. The underlying issue is improper input sanitization that could allow i...
CVE-2022-31186
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in next-auth before v4.10.2 and v3.29.9 allows an attacker with log access privilege to obtain excessive information such as an identity provider's secret in the log whi...
CLSA-2022-1658347450 Fixed CVE-2015-20170 in python2-4.module_el8.4.0+2071+0b56c8de.tuxcare.els3
CVE-2015-20170: mailcap: findmatch function does not sanitise the second argument allowing to inject shell commands...
CVE-2022-31150
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...
CVE-2022-31150 CRLF injection in request headers
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate \r\n is a workaround for this...