GHSA-7HMH-8GWV-MFVQ SQL Injection in Kylin

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries...

Command Injection in Kylin

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation...

GHSA-GPRM-XQRC-C2J3 Command Injection in Kylin

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation...

Code Injection in swooningfish/ffmpeg-web-gui

Description The ffmpeg-web-gui project is a simple video converter written in PHP which uses the ffmpeg command to convert videos in HTML formats. The issue arises at the following line: https://github.com/swooningfish/ffmpeg-web-gui/blob/master/upload-and-convert.phpL176. The arbitrary command...

Jenkins ( < 2.235.2 LTS / < 2.245 Weekly) Multiple Stored XSS (Jenkins Security Advisory 2020-07-15)

The version of Jenkins running on the remote web server is prior to 2.245 or is a version of Jenkins LTS prior to 2.235.2. It is, therefore, affected by multiple stored cross-site scripting XSS vulnerabilities in various components including its build time trend page, build cause page, tooltips &...

lemlist: Stored XSS at [ https://app.lemlist.com/campaigns/cam_QRS5caF2ca7MJtiLS/leads ] in " LINKEDIN URL" Field.

Summary: Vulnerability : A. Type:- Cross Site Scripting Stored B. Description:- Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Summary : When you will login into the...

Command injection

D-Link DSL-7740C does not properly validate user input, which allows an authenticated LAN user to inject arbitrary command...

Atlassian Jira 7.13.x < 8.3.0 XSS (JRASERVER-70856)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 7.13.x prior to 8.3.0. It is, therefore, affected by a cross-site scripting XSS vulnerability in the project configuration feature due to improper validation of user-supplied input...

Oracle E-Business Suite Human Resources SQL Injection (CVE-2020-2956)

An SQL execution vulnerability exists in the Position Hierarchy Viewer module of the Human Resources component in Oracle E-Business Suite. The vulnerability is due to use of untrusted user input to build a portion of an SQL query string...

Debian DLA-2282-1 : rails security update

Multiple vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execution and untrusted user input usage, depending on the application. CVE-2020-8163 A code injection vulnerability in Rails would allow an...

TYPO3 8.3 < 8.7.27 / 9.x < 9.5.8 XSS (TYPO3-CORE-SA-2019-015)

The version of TYPO3 installed on the remote host is 8.3 prior to 8.7.27 or 9.x prior to 9.5.8. It is, therefore, affected by a cross-site scripting XSS vulnerability in its t3 URL handling component due to improper validation of user-supplied input before returning it to users. An unauthenticate...

Debian: Security Advisory (DLA-2282-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2282-1] rails security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2282-1 [email protected] https://www.debian.org/lts/security/ July 20, 2020 https://wiki.debian.org/LTS - ------------------------------------------------------------------------- Package :...

Microsoft Hyper-V RemoteFX vGPU Buffer Overflow Vulnerability (CNVD-2020-45324)

Microsoft Windows is a popular operating system. A buffer overflow vulnerability exists in Microsoft Hyper-V RemoteFX vGPU that originates from a program's inability to properly validate authenticated user input on a virtual machine operating system. An attacker could exploit the vulnerability by...

Command Injection in 1000ch/install-package

Overview install-package is a package that installs node modules from JavaScript. This package is vulnerable to Command Injection, the argument options can be controlled by users without any sanitization giving attackers the ability to execute malicious code. POC var root =...

CVE-2020-3348

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

CVE-2020-3331

A vulnerability in the web-based management interface of Cisco RV110W Wireless-N VPN Firewall and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied...

CVE-2020-3349

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...

CVE-2020-3140

A vulnerability in the web management interface of Cisco Prime License Manager PLM Software could allow an unauthenticated, remote attacker to gain unauthorized access to an affected device. The vulnerability is due to insufficient validation of user input on the web management interface. An...

Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface on an affected device. These vulnerabilities are due to insufficient...