Cross site scripting

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting XSS attack against a user of the interface. These vulnerabilities are due to...

CVE-2020-7688

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

Design/Logic Flaw

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

CVE-2020-7688

The CVE-2020-7688 issue affects the npm package mversion . The vulnerability arises because the value of the input field tagName is formatted into a call to exec() without validation, enabling potential command injection. A proof-of-concept demonstrates injecting shell commands via tagName, illus...

CVE-2020-7688 Command Injection

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

SMTP2GO: Stored XSS at https://app.smtp2go.com/settings/users/

Vulnerability : A. Type:- Cross Site Scripting Stored B. Description:- Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Summary : When you will create a particular user...

Red Hat Ceph Injection Vulnerability

Red Hat Ceph is a Linux petabyte-level distributed file system from Red Hat. The main goal of the system is to be designed as a distributed file system based on POSIX Portable Operating System Interface without a single point of failure, so that data can be fault-tolerant and seamless replication...

CVE-2020-15017

NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the sta GET parameter...

OS Command Injection

node-traceroute is vulnerable to OS command injection. The Child.exec method accepts untrusted user input and allows an attacker to inject arbitrary OS commands after a newline character...

Insecure Direct Object Reference

telerik.web.ui is vulnerable to insecure direct object reference. User input is not validated and used directly by RadAsyncUpload without modification or validation. This can potentially result in arbitrary file uploads and executino of arbitrary code...

WordPress 10Web Photo Gallery Plugin SQL Injection

An SQL injection vulnerability exists in 10Web Photo Gallery Plugin for WordPress. The vulnerability is due to insufficient sanitization of user input...

CVE-2019-14076

Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Debian DLA-2251-1 : rails security update

Two vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execution and untrusted user input usage, depending on the application. CVE-2020-8164 Strong parameters bypass vector in ActionPack. In some cases us...

PT-2020-14070 · Squirrelmail · Squirrelmail

Name of the Vulnerable Software and Affected Versions: SquirrelMail version 1.4.22 Description: The issue arises in compose.php, where the $attachments value from an HTTP POST request is passed to unserialize. This could potentially lead to PHP object injection. However, the vendor disputes this,...

Zoho ManageEngine Directory Traversal (CVE-2020-12116)

A directory traversal vulnerability exists in ManageEngine OpManager. This vulnerability is due to improper validation of user input in the request URI...

[SECURITY] [DLA 2251-1] rails security update

Package : rails Version : 2:4.1.8-1+deb8u7 CVE ID : CVE-2020-8164 CVE-2020-8165 Two vulnerabilities were found in Ruby on Rails, a MVC ruby-based framework geared for web application development, which could lead to remote code execution and untrusted user input usage, depending on the applicatio...

Arbitrary Code Injection

thenify is vulnerable to arbitrary code execution. Untrusted user input is passed to the eval function which would allow an attacker to inject and execute arbitrary code on the system...

CVE-2020-3241

CVE-2020-3241. A path-traversal vulnerability in Cisco UCS Director’s orchestration tasks arises from insufficient validation of user-supplied input on the web-based management interface. An authenticated, remote attacker could craft a task with specific configuration parameters to overwrite arbi...

CVE-2020-3277 Cisco Small Business RV Series Routers Command Injection Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016, RV042, and RV082 Routers could allow an authenticated, remote attacker with administrative privileges to execute arbitrary commands on an affected...

WordPress < 5.4.2

According to its self-reported version number, the installation of WordPress installed on the remote host is affected by multiple vulnerabilities: - Multiple cross-site scripting XSS vulnerabilities exist in Wordpress due to improper validation of user-supplied input before returning it to users...