456 matches found
Cross site scripting
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
CVE-2022-40317
OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...
PT-2022-25345 · Openkm · Openkm
Name of the Vulnerable Software and Affected Versions: OpenKM version 6.3.11 Description: The issue allows stored XSS related to the javascript: substring in an A element. This could potentially lead to malicious script execution when a user interacts with the affected element. Recommendations: F...
CVE-2022-38794
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring...
Zaver 路径遍历漏洞
Zaver is a fast and efficient HTTP server for individual developers. A security vulnerability exists in Zaver version 2020-12-15 and earlier that stems from allowing directory traversal via substrings...
GHSA-2M9R-PM7Q-WR6F GeniXCMS denial of service (account blockage)
GeniXCMS before 1.1.0 allows remote attackers to cause a denial of service account blockage by leveraging the mishandling of certain username substring relationships, such as the admin username versus the admin username, related to register.php, User.class.php, and Type.class.php...
CVE-2021-44212
OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring...
CVE-2021-40857
Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring...
CVE-2021-40857: Insufficiently Protected Credentials
Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring...
Online Motorcycle (Bike) Rental System 1.0 - Blind Time-Based SQL Injection Exploit
Exploit Title: Online Motorcycle Bike Rental System 1.0 - Blind Time-Based SQL Injection Unauthenticated Exploit Author: Chase ComardelleCASO Vendor Homepage: https://www.sourcecodester.com/php/14989/online-motorcycle-bike-rental-system-phpoop-source-code.html Software Link:...
Suse Check_smart 输入验证错误漏洞
Suse Checksmart is a monitoring plugin from Suse Luxembourg. It is used to monitor the value of the Smart Self-Monitoring, Analysis and Reporting Technology attribute of hard and solid state drives in the background using Smartmontool's Smartctl. A security vulnerability exists in versions of...
CVE-2021-33525
EyesOfNetwork eonweb through 5.3-11 allows Remote Command Execution by authenticated users via shell metacharacters in the nagiospath parameter to lilac/export.php, as demonstrated by %26%26+curl to insert an "&& curl" substring for the shell...
PYSEC-2021-743
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via CHECK-fail in tf.strings.substr with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3,...
PYSEC-2021-743
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via CHECK-fail in tf.strings.substr with invalid arguments. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3,...
DEBIAN-CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...
UBUNTU-CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...
CVE-2021-26120
Smarty before 3.1.39 allows code injection via an unexpected function name after a function name= substring...
Design/Logic Flaw
An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page...