Liberapay: Missing back-end user input validation can lead to DOS flaw

Hello Team, Usually such kind of reports are out of scope, however I still would like to report you the business logic weakness that should be eliminated, at least from my point of view. Due to missing user input validation it is can lead to application unavailability. Details: During brief revie...

DEBIAN-CVE-2016-10537

backbone is a module that adds in structure to a JavaScript heavy application through key-value pairs and custom events connecting to your RESTful API through JSON There exists a potential Cross Site Scripting vulnerability in the ModelEscape function of backbone 0.3.3 and earlier, if a user is...

CVE-2016-10548

Arbitrary code execution is possible in reduce-css-calc node module =1.2.4 through crafted css. This makes cross sites scripting XSS possible on the client and arbitrary code injection possible on the server and user input is passed to the calc function...

CVE-2016-10520

jadedown is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in...

CVE-2016-10520

jadedown is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in...

CVE-2016-10521

jshamcrest is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in to the emailAddress validator...

CVE-2015-9239

ansi2html is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in...

CVE-2016-10521

jshamcrest is vulnerable to regular expression denial of service ReDoS when certain types of user input is passed in to the emailAddress validator...

CVE-2016-10520

CVE-2016-10520 affects the jadedown package and is a Regular Expression Denial of Service (ReDoS) vulnerability triggered by certain user inputs. The connected GHSA advisory provides a PoC-style example illustrating a crafted input causing prolonged blocking, and notes the issue was identified in...

CVE-2018-11139

The '/common/ajaxemailconnectiontest.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TESTSERVER'...

CVE-2017-16010

i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but i...

Cross site scripting

i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefined rather than the assumed true. This can result in a cross-site scripting vulnerability because user input is assumed to be escaped, but i...

CVE-2016-10551

waterline-sequel is a module that helps generate SQL statements for Waterline apps Any user input that goes into Waterline's like, contains, startsWith, or endsWith will end up in waterline-sequel with the potential for malicious code. A malicious user can input their own SQL statements in...

TYPO3 T3Blog Extbase Extension Cross-Site Scripting Vulnerability

Typo3 is one of the leading brands of open source content management systems CMS and content management frameworks CMF based on PHP and MySQL databases and is a powerful open source solution. A cross-site scripting vulnerability exists in TYPO3 T3Blog Extbase Extension that stems from...

ClipperCMS 1.3.3 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: ClipperCMS 1.3.3 Persistent XSS on 'Site name' field Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: http://www.clippercms.com/ Software Link:...

Directory Traversal

Opencart is vulnerable to directory traversal attacks. The application does not sanitize user input directory strings, allowing a malicious user to conduct a directory traversal attack by passing a string like ../../config.php to the application...

ClipperCMS 1.3.3 - Cross-Site Scripting

ClipperCMS 1.3.3 - Cross-Site Scripting Exploit Title: ClipperCMS 1.3.3 Persistent XSS on 'Site name' field Date: 05/27/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: http://www.clippercms.com/ Software Link:...

CVE-2017-3961

Cross-Site Scripting XSS vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes...

Cross site scripting

Cross-Site Scripting XSS vulnerability in the web interface in McAfee Network Security Management NSM before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes...

PT-2018-23: Remote Code Execution in PRTG Network Monitor

The specialists of the Positive Research center have detected a Remote Code Execution vulnerability in PRTG Network Monitor. Vulnerability due to improper handling of user input in the POST parameter 'proxyport' allows remote authenticated attackers with read-write privileges to execute an...