CVE-2024-27716

Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the message sending and user input fields...

CVE-2024-27716

Eskooly Web Product (versions 3.0 and earlier) has a Cross Site Scripting (XSS) vulnerability that can allow a remote attacker to execute arbitrary code via message sending and user input fields. Root cause is XSS in the web product; impact includes arbitrary code execution. Remediation guidance ...

Cross Site Scripting(XSS)

Flowise is vulnerable to Cross Site ScriptingXSS. The vulnerability is caused due to improper handling of user input in the /api/v1/chatflows-streaming/id endpoint, which allows an attacker to craft a URL that injects Javascript into user sessions, potentially stealing information, creating false...

CVE-2024-36404 GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution RCE is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6...

SQL Injection

typo3/cms is vulnerable to SQL Injection. The vulnerability is due to improperly user input neutralization, allowing user with a valid frontend account to potentially execute SQL queries...

CVE-2024-5419 Void Contact Form 7 Widget For Elementor Page Builder <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7_redirect_page Attribute

The Void Contact Form 7 Widget For Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cf7redirectpage' attribute within the plugin's Void Contact From 7 widget in all versions up to, and including, 2.4 due to insufficient input sanitization and outpu...

GeoTools Security Vulnerabilities

GeoTools is an open source Java library. Provides tools for geospatial data. A security vulnerability exists in GeoTools that stems from Remote Code Execution RCE that may occur if the application uses certain functions to evaluate XPath expressions provided by user input...

CVE-2024-21465

Memory corruption while processing key blob passed by the user...

CVE-2024-21465

CVE-2024-21465 : Memory corruption while processing a key blob passed by the user. Documents indicate this affects Qualcomm closed‑source components and is rated High impact (C:H, I:H, A:H) with LOCAL attacker access and LOW privileges required, no user interaction. The CVSS metrics imply local e...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to Cross-site Scripting. The vulnerability is due to failing to properly encode user input in some backend components...

Medium: python-jinja2

Issue Overview: Jinja is an extensible templating engine. The xmlattr filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-34091)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

PrivateGPT Input Validation Error Vulnerability

PrivateGPT is an AI project. An input validation error vulnerability exists in PrivateGPT version 0.5.0 that stems from mishandling of the file parameter, allowing an attacker to redirect a user to a URL specified by user-controlled input without proper validation or cleanup...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failing to properly encode user input in the login status display in the website frontend, requiring a valid user account either backend or frontend to exploit...

Cross-site Scripting (XSS)

TYPO3 is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failing to properly encode user input in notifications shown in modal windows in the TYPO3 backend...

Cross-site Scripting (XSS)

typo3/cms is vulnerable to Cross-site Scripting XSS. The vulnerability is due to failing to properly encode user input in online media asset rendering for .youtube and .vimeo files, requiring a valid backend user account or write access on the server system to exploit...

CVE-2024-28831 XSS in confirmation pop-up

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up...

CVE-2024-28831 XSS in confirmation pop-up

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up...

CVE-2024-28831 XSS in confirmation pop-up

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up...

Cross-site Scripting (XSS)

org.apache.jspwiki:jspwiki-builder is vulnerable to Cross-site Scripting XSS. The vulnerability is caused by a lack of proper sanitization for the certain characters of user input within Wiki.js. This allows an attacker to potentially inject and execute malicious scripts in the context of the...