164 matches found
Cross-site Scripting (XSS)
silverstripe/framework is vulnerable to cross-site scripting. The vulnerability exists in the sanitise function of HTMLEditorSanitiser.php because of uppercase characters in HTMLEditor which allows an attacker to inject and execute malicious JavaScript...
Archive_Tar: allows an unserialization attack because phar: is blocked but PHAR: is not blocked
ArchiveTar through 1.4.10 allows an unserialization attack because phar: is blocked but PHAR: is not blocked...
Cross-site Scripting (XSS)
forkcms/forkcms is vulnerable to cross-site scripting attacks. The vulnerability exists because the SpoonLibrary does not properly handle uppercase characters, which allows remote authenticated attackers to inject and execute malicious javascript via the publishontime Parameter...
CVE-2022-35923
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the "lowercase" and "uppercase" regex which could lead to a denial of service attack. In testing of the "lowercase" function a payload of 'a' + 'a'.repeati + '...
v8n 安全漏洞
v8n is a JavaScript validation library by the individual developer Bruno C. Couto. A security vulnerability exists in versions of v8n prior to 1.5.1, which stems from the fact that the low complexity of its lowercase and uppercase regular expressions may lead to denial-of-service attacks...
PT-2022-23029 · V8N · V8N
Name of the Vulnerable Software and Affected Versions: v8n versions prior to 1.5.1 Description: The issue is related to an inefficient regular expression complexity in the lowercase and uppercase regex of the v8n javascript validation library. This could lead to a denial of service attack. Testin...
CVE-2022-35923: Uncontrolled Resource Consumption
v8n is a javascript validation library. Versions of v8n prior to 1.5.1 were found to have an inefficient regular expression complexity in the lowercase and uppercase regex which could lead to a denial of service attack. In testing of the lowercase function a payload of 'a' + 'a'.repeati + 'A' wit...
Oracle Linux 8 : grafana (ELSA-2022-1781)
The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2022-1781 advisory. - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache - resolve CVE-2021-43813 grafana: directory traversal vulnerability for...
GHSA-V358-RVXR-WFFX Silverstripe XSS Vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in SilverStripe 2.3.x before 2.3.13 and 2.4.x before 2.4.7 allow remote attackers to inject arbitrary web script or HTML via 1. a crafted string to the AbsoluteLinks 1. BigSummary 1. ContextSummary 1. EscapeXML 1. FirstParagraph 1. FirstSentence 1...
CVE-2021-46372
Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...
CVE-2021-46372
Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...
CVE-2021-46372
Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...
CVE-2021-46372
Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...
CVE-2021-46372: Improper Neutralization of Input During Web Page Generation
Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A, the markdown editor is vulnerable to a XSS attack when using uppercase letters...
GHSA-J5QG-W9JG-3WG3 Inability to de-op players if listed in ops.txt with non-lowercase letters
Impact Originally reported in iTXTech/Genisys1188 txt PotterHarry98 potterharry98 deop PotterHarry98 will remove potterharry98 from the ops.txt but not PotterHarry98. Operator permissions are checked using Config-exists with lowercase=true, which will result in a match:...
Grafana 5.0.0 - 8.3.1 Directory Traversal Vulnerability
Grafana is prone to a directory traversal vulnerability for Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
CVE-2021-43813
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension...
Directory traversal
Grafana is an open-source platform for monitoring and observability. Grafana prior to versions 8.3.2 and 7.5.12 contains a directory traversal vulnerability for fully lowercase or fully uppercase .md files. The vulnerability is limited in scope, and only allows access to files with the extension...
Acronis: Reflected Cross Site Scripting at http://www.grouplogic.com/files/glidownload/verify3.asp [Uppercase Filter Bypass]
Summary The below URL checks if the product serial number provided in the url parameter serial is valid or not. http://www.grouplogic.com/files/glidownload/verify3.asp?version=CC1100x7660&serial= If an invalid product serial is provided, the user submitted serial is displayed in the response. It...
Design/Logic Flaw
bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character, defeating a protection mechanism against the "script" string...