CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

Cross site scripting

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

CVE-2019-13146

CVE-2019-13146 concerns the field_test gem (Ruby) 0.3.0, where unvalidated input allows a method to return arbitrary inputs. The root cause is acceptance of arbitrary variants from user-supplied input, enabling potential SQL injection or XSS when trusted values are used. Multiple connected source...

CVE-2019-13146

The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead...

Template Injection

fieldtest is vulnerable to template injection. Unvalidated input allows an attacker to pass arbitrary variants via query parameters. This can potentially lead to cross-site scripting vulnerabilities or SQL injection...

Arbitrary Variants Via Query Parameters

Due to unvalidated input, an attacker can pass in arbitrary variants via query parameters. If an application treats variants as trusted, this can lead to potential vulnerabilities like SQL injection or cross-site scripting XSS. For instance: landingpage = fieldtest:landingpage Page.where"key =...

CVE-2018-15730

An issue was discovered in STOPzilla AntiMalware 6.5.2.59. The driver file szkg64.sys contains a Denial of Service vulnerability due to not validating the output buffer address value from IOCtl 0x80002067...

ENTTEC Datagate Mk2 Cross-Site Scripting Vulnerability

The ENTTEC Datagate MK2 is a lighting controller from ENTTEC Australia. A cross-site scripting vulnerability exists in the Web Configuration feature in the ENTTEC Datagate Mk2 70044update05032019-482 release. The vulnerability stems from the WEB application lacking proper validation of client dat...

IBM Jazz for Service Management Input Validation Error Vulnerability

IBM Jazz for Service Management is an integrated service management product from IBM that provides visibility into the service management environment. An input validation error vulnerability exists in IBM Jazz for Service Management. The vulnerability originates from a network system or product...

DEBIAN-CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

PYSEC-2019-79

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

UBUNTU-CVE-2019-12308

An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provid...

CVE-2019-10048

The ImageMagick plugin that is installed by default in Pydio through 8.2.2 does not perform the appropriate validation and sanitization of user supplied input in the plugin's configuration options, allowing arbitrary shell commands to be entered that result in command execution on the underlying...

Vtiger CRM SQL Injection Vulnerability (CNVD-2019-16507)

Vtiger CRM is a set of customer relationship management system CRM based on SugarCRM developed by American Vtiger. The management system provides management, collection and analysis of customer information and other functions. A SQL injection vulnerability exists in the...

Intel i915 Graphics Kernel Mode Driver Input Validation Error Vulnerability

Intel i915 Graphics is a set of graphics card drivers from Intel Corporation.Kernel Mode Driver is one of the kernel mode drivers. An input validation error vulnerability exists in the Intel i915 Graphics Kernel Mode Driver. The vulnerability arises from a networked system or product that does no...

CommSy SQL Injection Vulnerability

Commsy is a Web-based, open source community system for project management. A SQL injection vulnerability exists in CommSy version 8.6.5. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit this vulnerabili...

Microsoft Windows Jet Database Engine Buffer Overflow Vulnerability (CNVD-2019-24832)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows Jet Database Engine is one of the database engines. A buffer overflow vulnerabilit...

OpenProject SQL Injection Vulnerability

OpenProject is an open source Web-based project management software . The software has project planning , task management , bug tracking and cost budgeting and other functions . A SQL injection vulnerability exists in OpenProject versions 5.0.0 through 8.3.1. The vulnerability stems from a lack o...