Information Disclosure

Red Hat Satellite's Job Invocation is vulnerable to information disclosure. The User Input entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data...

CVE-2020-11016

IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue...

Design/Logic Flaw

IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue...

Cross-site Scripting (XSS)

typo3/cms-backend is vulnerable to cross-site scripting XSS attacks.The library does not properly encode user input strings before being displayed, allowing a malicious user to inject and execute malicious web script on a user's browser...

Command Injection Vulnerability in Multiple NETGEAR Products (CNVD-2021-46561)

NETGEAR R7500 and others are products of NETGEAR USA.NETGEAR R7500 is a wireless router.NETGEAR D6100 is a wireless modem.NETGEAR R6100 is a wireless router. An injection vulnerability exists in multiple NETGEAR products. The vulnerability arises from a lack of proper validation of user input dat...

OS Command Injection

git-promise is vulnerable to OS commnad injection. User input is not validated and sanitized before being passed to the git function and executed...

Cross-site Scripting (XSS)

forkcms/forkcms is vulnerable to cross-site scripting XSS attacks. The library doesn't properly escape user input displayname value in the function loadDataGrid in Index.php allowing a malicious user to inject and execute malicious web script...

GitLab: Stored XSS on PyPi simple API endpoint

Summary The recently released PyPi package feature has a new endpoint at /api/:version/projects/:id/packages/pypi/simple/packagename which exposes an HTML page listing the package versions. The packagelink's are generated using the following code: packagepresenter.rbL50 ruby def packagelinkurl,...

Multiple NETGEAR Product Injection Vulnerabilities (CNVD-2021-59159)

NETGEAR R7000 is a wireless router, NETGEAR D3600 is a wireless modem, and NETGEAR WNDR3700 is a wireless router. An injection vulnerability exists in multiple NETGEAR products. The vulnerability stems from a lack of proper validation of user input data by a network system or product during user...

NETGEAR D6100 Injection Vulnerability

The NETGEAR D6100 is a wireless modem from NETGEAR. An injection vulnerability exists in versions prior to NETGEAR D6100 1.0.0.500.0.50. The vulnerability arises from a lack of proper validation of user input data by the network system or product during user input operations of constructed...

Injection Vulnerability in Multiple NETGEAR Products (CNVD-2021-61051)

NETGEAR R7800 and others are products of NETGEAR, Inc.NETGEAR R7800 is a wireless router.NETGEAR D7800 is a wireless modem.NETGEAR WNDR4300 is a wireless router. An injection vulnerability exists in multiple NETGEAR products. The vulnerability arises from a lack of proper validation of user input...

IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.15 / 9.x < 9.0.0.10 XSS (CVE-2018-1794)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.x prior to 8.5.5.15, or 9.x prior to 9.0.0.10. It is, therefore, affected by a cross-site scripting XSS vulnerability in the OAuth ear due to improper validation of...

Code Injection in rapidfacture/pdf-toolz

Description The pdf-toolz module is vulnerable against arbitrary command injection due to the fact some inputs given by the user are unsafely processed and executed. POC 1. Create the following PoC file: js // poc.js var pdf = require'pdf-toolz/PDF2Image'; pdf.pdfToImage"a", "test; touch HACKED; ...

Cisco Unified Computing System Fabric Interconnect Root Privilege Escalation (cisco-sa-20190828-ucs-privescalation)

According to its self-reported version, Cisco NX-OS Software on Cisco Unified Computing System Fabric Interconnects is affected by a vulnerability in a specific CLI command within the local management local-mgmt context due to extraneous subcommand options. An authenticated, local attacker can...

CVE-2020-7261

Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security ENS Prior to 10.7.0 February 2020 Update allows local users to disable Endpoint Security via a carefully crafted user input...

Buffer overflow

Buffer Overflow via Environment Variables vulnerability in AMSI component in McAfee Endpoint Security ENS Prior to 10.7.0 February 2020 Update allows local users to disable Endpoint Security via a carefully crafted user input...

GHSA-4GP3-P7PH-X2JR OS Command Injection in devcert-sanscache

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName controlled by user input is used as part of the exec function without any sanitization...

OS Command Injection in devcert-sanscache

devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable commonName controlled by user input is used as part of the exec function without any sanitization...

CVE-2020-6222

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface, versions 4.1, 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2020-6231

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface, version 4.2, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability...