The vulnerability of the Cisco IOX software platform arises from the lack of measures taken to protect the structure of the web page, allowing attackers to enhance their privileges.

The vulnerability of the Cisco IOx software platform exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the virtual learning environment Moodle, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability in the virtual learning environment Moodle is related to the lack of measures taken to protect the structure of the web page when using user identification numbers. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially...

LibreNMS Information Disclosure

An issue was discovered in LibreNMS through 1.47. The scripts that handle graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

Design/Logic Flaw

A vulnerability has been identified in Simcenter Femap All versions V2022.2. The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted .NEU files. This could allow an attacker to execute code in the context of the current...

The vulnerability of the Microsoft Dynamics 365 Business Central and integrated enterprise management system for small and medium-sized businesses lies in the lack of security measures for the website structure. This allows attackers to execute cross-site scripting attacks.

The vulnerability of the Microsoft Dynamics 365 Business Central and integrated enterprise management system relates to the lack of security measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Aruba ClearPass Policy Manager Command Injection Vulnerability (CNVD-2022-64231)

Aruba ClearPass Policy Manager is an application of the U.S. company Aruba to provide wireless network security access management system Aruba ClearPass Policy Manager has a command injection vulnerability, the vulnerability stems from the user input structure to execute the command process, the...

Long lost @ symbol gets new life obscuring malicious URLs

Threat actors have rediscovered an old and little-used feature of web URLs, the innocuous @ symbol we usually see in email addresses, and started using it to obscure links to their malicious websites. Researchers from Perception Point noticed it being used in a cyberattack against multiple...

phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page

Multiple cross-site scripting XSS vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 a crafted table name during table creation, or a 2 Empty link or 3 Drop link...

GHSA-R3PQ-MP8V-CP33 phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page

Multiple cross-site scripting XSS vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via 1 a crafted table name during table creation, or a 2 Empty link or 3 Drop link...

phpMyAdmin cross-site scripting Vulnerability via ENUM value

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the 1 table search...

GHSA-WV8G-FX9J-Q2JG phpMyAdmin cross-site scripting Vulnerability via ENUM value

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the 1 table search...

phpMyAdmin XSS Vulnerability

Multiple cross-site scripting XSS vulnerabilities in the partition-range implementation in templates/table/structure/displaypartitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters...

GHSA-3Q28-XFW3-2Q35 phpMyAdmin XSS Vulnerability

Multiple cross-site scripting XSS vulnerabilities in the partition-range implementation in templates/table/structure/displaypartitions.phtml in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters...

Apache OpenMeetings vulnerable to SQL injection

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end. The issue is fixed in version 3.3.0...

The vulnerability of the social-warfare plugin in the WordPress content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the social-warfare plugin in the WordPress content management system exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

GHSA-CCMR-QJ26-845G Improper Restriction of XML External Entity Reference in Elasticsearch

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content ...

GHSA-688P-PGJ4-77HH Moodle allows attackers to obtain sensitive course-structure information

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

Moodle allows attackers to obtain sensitive course-structure information

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

Updated gerbv packages fix security vulnerability

An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and dev commit b5f1eacd, and Gerbv forked 2.8.0. A specially-crafted pick-and-place file can exploit the missing initialization of a structure to leak memory contents. An attacker ca...

OSV-2022-409 Heap-buffer-overflow in std::__1::__tree_node_base<void*>*& std::__1::__tree<std::__1::__value_type<std:

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47391 Crash type: Heap-buffer-overflow READ 1 Crash state: std::1::treenodebase& std::1::treestd::1::valuetypestd: std::1::pairstd::1::treeiteratorstd::1::valuetypestd::1::basic...