GHSA-RQF8-8C89-MW29 Cross-site Scripting in curly-bracket-parser

This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input...

Cross-site Scripting in curly-bracket-parser

This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input...

Custom Post View Generator <= 0.4.6 - Reflected Cross-Site Scripting

The createpostpage AJAX action of the plugin available to authenticated user does not sanitise or escape user input before outputting it back in the response, leading to a Reflected Cross-Site issue PoC...

TYPO3 跨站脚本漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland. TYPO3 suffers from a cross-site scripting vulnerability that stems from a failure to properly encode user input. No detailed vulnerability details are currently available...

Cross Site Scripting in Extension "Yoast SEO for TYPO3" (yoast_seo)

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...

ZTE ZXIPTV Cross-Site Scripting Vulnerability

ZTE ZXIPTV is a set-top box from ZTE ZTE. A cross-site scripting vulnerability exists in ZTE ZXIPTV EASP version 5.06.04.09, which stems from the application's lack of validation of user input data and filtering of input data. The vulnerability can be exploited by an attacker to trick a user into...

Cisco Issues Critical Security Patches to Fix Small Business VPN Router Bugs

Networking equipment major Cisco has rolled out patches to address critical vulnerabilities impacting its Small Business VPN routers that could be abused by a remote attacker to execute arbitrary code and even cause a denial-of-service DoS condition. The issues, tracked as CVE-2021-1609 CVSS scor...

CVE-2021-1602 Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to...

CVE-2021-1602 Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to...

Cisco Small Business RV160 and RV260 Series VPN Routers Remote Command Execution Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to...

CSZ CMS has an unspecified vulnerability

CSZ CMS is a PHP-based open source content management system CMS. version 1.2.9 of CSZ CMS contains a security vulnerability that stems from the vulnerability of CSZ CMS to arbitrary file deletion. This can occur in PHP when the unlink function is called with user input that may affect part or th...

Argo 输入验证错误漏洞

Argo is an open source container-native workflow engine. A security vulnerability exists in Argo Workflows 3.1.3 that could allow an attacker to corrupt a workflow if EXPRESSIONTEMPLATES is enabled and an untrusted user is allowed to specify input parameters when running the workflow...

CVE-2021-37144

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization...

CVE-2021-37144

CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization...

curly-bracket-parser cross-site scripting vulnerability

curly-bracket-parser is an application. A bracket parser. curly-bracket-parser suffers from a cross-site scripting vulnerability that stems from a failure to properly clean up user input when used as a template library, which can be exploited by attackers to conduct cross-site scripting attacks...

Cross-site Scripting (XSS)

curly-bracket-parser is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript in a user's browser when used as a template library due to lack of user input sanitization...

RabbitMQ < 3.8.18 XSS

Pivotal RabbitMQ versions prior to 3.8.18 are affected by a cross-site scripting XSS vulnerability in the rabbitmqfederationmanagement plugin due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user ...

GO-2021-0112 Improper input validation in go.mongodb.org/mongo-driver

Due to improper input sanitization when marshalling Go objects into BSON, a maliciously constructed Go structure could allow an attacker to inject additional fields into a MongoDB document. Users are affected if they use this package to handle untrusted user input...

CVE-2021-23416

This affects all versions of package curly-bracket-parser. When used as a template library, it does not properly sanitize the user input...

CVE-2021-23416

CVE-2021-23416 : Cross-site Scripting in curly-bracket-parser affects all versions when used as a template library due to improper sanitization of user input. The vulnerability enables injection of malicious scripts through template processing. Public advisories (GHSA/OSV) corroborate XSS across ...