4228 matches found
PT-2020-9304
Name of the Vulnerable Software and Affected Versions BlueMail versions 1.9.5.36 and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For BlueMail versio...
PT-2020-9306
Name of the Vulnerable Software and Affected Versions TypeApp versions 1.9.5.35 and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For TypeApp versions...
PT-2020-9303
Name of the Vulnerable Software and Affected Versions The Nine application versions 4.5.3a and earlier Description The issue allows for XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READ EXTERNAL STORAGE permission. Recommendations For...
PT-2020-9302
Name of the Vulnerable Software and Affected Versions Newton application versions prior to 10.0.24 Description The issue allows for cross-site scripting XSS via an event attribute and arbitrary file loading via a src attribute. This can occur if the application has the READ EXTERNAL STORAGE...
PT-2020-9307
Name of the Vulnerable Software and Affected Versions Spark application versions 2.0.2 and earlier Description The issue allows for cross-site scripting XSS via an event attribute and arbitrary file loading via a src attribute, provided the application has the READ EXTERNAL STORAGE permission...
CVE-2019-12368: Improper Neutralization of Input During Web Page Generation
The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...
CVE-2019-12367: Improper Neutralization of Input During Web Page Generation
The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute, if the application has the READEXTERNALSTORAGE permission...
OS Command Injection
pulverizr is vulnerable to OS Command Injection. The vulnerability exists as the value of src is improperly handled by src/command.js...
CVE-2020-7601
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
CVE-2020-7601
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
CVE-2020-7601
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
CVE-2020-7601: Improper Neutralization of Special Elements used in an OS Command
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
Command Injection
Overview gulp-scss-lint is a Lint your .scss files. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands to the exec function located in src/command.js via the provided options. PoC by JHU System Security Lab var root =...
Authentication flaw
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...
CVE-2019-10796
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...
WS-2020-0343
ndpi in versions 1.7 to 3.2 is vulnerable to Heap-buffer-overflow, related to src/lib/protocols/dns.c, src/lib/protocols/fix.c, src/lib/protocols/ssh.c and src/lib/protocols/yahoo.c...
PT-2020-9147
Name of the Vulnerable Software and Affected Versions rpi versions 0.0.0 through 0.0.3 Description The issue allows execution of arbitrary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the argument of exec function without any sanitization...
CVE-2019-10796: Improper Neutralization of Special Elements used in an OS Command
rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...