PT-2022-13870 · Red Hat · 3Scale Api Management 2

Name of the Vulnerable Software and Affected Versions: 3scale API Management 2 Description: The issue arises from inadequate sanitation of user input in multiple fields, allowing an authenticated user to inject scripts. This could potentially lead to access to sensitive information or further...

CVE-2022-1414

3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks...

Sql injection

RAVA certificate validation system has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL command to access, modify and delete database...

Cross-site Scripting (XSS)

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to Cross-site Scripting XSS through insufficient output escaping on user-supplied input. An attacker can inject and execute malicious scripts by crafting...

golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

GHSA-69CH-W2M2-3VJP golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

SAP Enable Now Cross-Site Scripting Vulnerability

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now 10 version 1. The vulnerability stems from failure to...

Apache Commons JXPath buffer overflow vulnerability

Apache Commons JXPath is a Java-based implementation of XPath 1.0 from the Apache Foundation in the U.S. A buffer overflow vulnerability exists in Apache Commons JXPath, which stems from a parser running on user-supplied input allowing an attacker to submit special data causing a stack overflow t...

CVE-2022-20423

In rndissetresponse of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2022-26323 · Unknown · Student Clearance System

Name of the Vulnerable Software and Affected Versions: Student Clearance System version 1.0 Description: A Stored XSS issue allows the injection of arbitrary JavaScript in the Student registration form. Recommendations: For version 1.0, update the Student registration form to properly sanitize us...

rdiffweb vulnerable to Open Redirect

A lack of user input validation leads to an open redirect vulnerability in rdiffweb prior to 2.5.0a4...

ASUS RT-AX56U Buffer Overflow Vulnerability

ASUS RT-AX56U is a wireless router from ASUS, China.ASUS RT-AX56U Router firmware version 3.0.0.4.386.44266 has a buffer overflow vulnerability, which stems from the strcat function's lack of length checks for user input data, which can be exploited by attackers to remotely execute commands...

CVE-2022-32590

In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07299425; Issue ID: ALPS07299425...

[20221002] - Core - RXSS through reflection of user input in headings

Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components...

JXPath Out-of-bounds Write vulnerability

Withdrawn This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. Original Description Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

GHSA-C7MC-Q43H-5672 JXPath Out-of-bounds Write vulnerability

Withdrawn This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. Original Description Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

PT-2022-25253 · Jxpath · Jxpath

Name of the Vulnerable Software and Affected Versions: JXPath affected versions not specified Description: The issue concerns a potential Denial of Service DOS attack when using JXPath to interpret XPath. If the parser processes user-supplied input, an attacker could provide content that causes t...

PT-2022-25252 · Jxpath · Jxpath

Name of the Vulnerable Software and Affected Versions: JXPath affected versions not specified Description: The issue allows for Denial of Service attacks. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash by stackoverflow, potentially...

Apache Commons JXPath 缓冲区错误漏洞

Apache Commons JXPath is a Java-based implementation of XPath 1.0 from the Apache Foundation. Apache Commons JXPath suffers from a buffer error vulnerability that stems from a parser running on user-supplied input that allows an attacker to submit special data resulting in a denial of service due...

PT-2022-25255 · Apache · Jxpath

Name of the Vulnerable Software and Affected Versions: JXPath affected versions not specified Description: The issue allows for Denial of Service attacks if the parser is running on user-supplied input. An attacker may supply content that causes the parser to crash by stackoverflow, potentially...