PT-2021-21127 · Mediawiki +1 · Mediawiki +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.36 SocialProfile extension in MediaWiki versions through 1.36 Description: An XSS issue was discovered in the SocialProfile extension within MediaWiki. A privileged user with the awardmanage right could inject...

CVE-2021-31658

TP-Link TL-SG2005, TL-SG2008, etc. 1.0.0 Build 20180529 Rel.40524 is affected by an Array index error. The interface that provides the "device description" function only judges the length of the received data, and does not filter special characters. This vulnerability will cause the application t...

CVE-2021-33357

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

Design/Logic Flaw

A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...

SUSE: Security Advisory (SUSE-SU-2020:1609-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2021-3373 · Unknown · Vp9 Video Extensions

Name of the Vulnerable Software and Affected Versions: VP9 Video Extensions affected versions not specified Description: The issue is related to incorrect code generation management in the VP9 Video Extensions package. An attacker can exploit this by sending a specially crafted request, potential...

Sifchain: Cross-site Scripting (XSS) possible at https://sifchain.finance// via CVE-2019-8331 exploitation

Summary: https://sifchain.finance is using Bootstrap framework version 4.0.0 which is =4.0.0 4. Visit https://sifchain.finance/wp-content/themes/icos/assets/js/vendor/bootstrap.min.js?ver=5.7.2 5. You'll get the Bootstrap Version, Which is v4.0.0 and its vulnerable to Cross-site Scripting XSS...

Debian DLA-2675-1 : caribou regression update

It was found that the fix for CVE-2020-25712 in the Xorg X server, addressed in DLA-2486-1, caused a regression in caribou, making it crash whenever special shifted characters were entered. For Debian 9 stretch, this problem has been fixed in version 0.4.21-1+deb9u1. We recommend that you upgrade...

The vulnerability of the VisitMixin and visitMixinBlock functions in the HTML Pug preprocessor allows a hacker to execute arbitrary code.

The vulnerability of the VisitMixin and visitMixinBlock functions in the HTML Pug preprocessor is related to deficiencies in the process of eliminating special elements from the output data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

UBUNTU-CVE-2021-29507

GENIVI Diagnostic Log and Trace DLT provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail t...

CVE-2021-29507

GENIVI Diagnostic Log and Trace DLT provides a log and trace interface. In versions of GENIVI DLT between 2.10.0 and 2.18.6, a configuration file containing the special characters could cause a vulnerable component to crash. All the applications which are using the configuration file could fail t...

CVE-2021-32539

Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack...

Cross site scripting

Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack...

Cross site scripting

The parameters of the specific functions in the CTS Web trading system do not filter special characters, which allows unauthenticated attackers can remotely perform reflected XSS and obtain the users’ connection token that triggered the attack...

CVE-2021-32540 Hundred Plus 101EIP - Stored XSS-2

Add announcement function in the 101EIP system does not filter special characters, which allows authenticated users to inject JavaScript and perform a stored XSS attack...

CVE-2021-32539 Hundred Plus 101EIP - Stored XSS-1

Add event in calendar function in the 101EIP system does not filter special characters in specific fields, which allows remote authenticated users to inject JavaScript and perform a stored XSS attack...

CVE-2021-30187

CODESYS V2 runtime system SP before 2.4.7.55 has Improper Neutralization of Special Elements used in an OS Command...

CVE-2021-29695

IBM Host firmware for LC-class Systems could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request that would allow them to delete arbitrary files on the system. IBM X-Force ID: 200558...

Huawei S5700 and S5800 Denial of Service Vulnerability

A denial-of-service vulnerability exists in the Huawei S5700 and Huawei S6700, both enterprise switches from Huawei of China. The vulnerability stems from a program that does not properly validate input. An attacker could use the vulnerability to cause a service exception on the target device by...

MikroTik RouterOS 数字错误漏洞

MikroTik RouterOS is a router operating system developed on Linux. A memory corruption vulnerability exists in MikroTik RouterOS /ram/pckg/advanced-tools/nova/bin/netwatch, which allows remote attackers to exploit the vulnerability by submitting a special request that can crash an application and...