14363 matches found
Cross-Site Scripting (XSS)
phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to improper user input sanitization in add.php which allows an attacker to inject and execute arbitrary scripts...
GHSA-J8WR-FWF2-VVR9 Command Injection in create-choo-electron
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
Command Injection in create-choo-electron
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
CVE-2023-23950
User’s supplied input usually a CRLF sequence can be used to split a returning response into two responses...
Input validation
User’s supplied input usually a CRLF sequence can be used to split a returning response into two responses...
CVE-2022-25908
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
Input validation
All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution RCE in the ExpressionContextImpl class via jexl.createExpressionexpression.evaluatecontext; functionality, due to improper user input validation...
Command injection
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization...
Cross-Site Scripting (XSS)
phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to improper sanitization of user inputs in index.php which allows an attacker to inject and execute arbitrary JavaScript...
Cross-Site Scripting (XSS)
thorsten/phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper user input sanitization in record.comments.php which allows an attacker to inject and execute arbitrary scripts...
CVE-2022-4092
An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. It was possible to create a malicious README page due to improper neutralisation of user supplied input...
Centreon SQL注入漏洞
Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . The product provides monitoring capabilities for resources such as networks, systems, and applications. A security vulnerability exists in Centreon due to a failure to properly validate...
CVE-2022-25894
All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution RCE in the ExpressionContextImpl class via jexl.createExpressionexpression.evaluatecontext; functionality, due to improper user input validation...
PT-2023-12830 · Bstek · Uflo-Core
Name of the Vulnerable Software and Affected Versions: com.bstek.uflo:uflo-core affected versions not specified Description: The issue concerns improper user input validation in the ExpressionContextImpl class, specifically via the jexl.createExpressionexpression.evaluatecontext functionality,...
CVE-2023-24494
Tenable.sc versions prior to 6.0.0 are affected by a stored XSS vulnerability (CVE-2023-24494) due to improper validation of user-supplied input. An authenticated attacker can entice a user to click a crafted URL, causing script execution in the user’s browser session. The issue is rooted in inpu...
CVE-2023-24493
A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a...
PT-2023-19639 · Tenable · Tenable.Sc
Name of the Vulnerable Software and Affected Versions: Tenable.sc affected versions not specified Description: A formula injection issue exists due to improper validation of user-supplied input. An authenticated attacker could leverage the reporting system to export reports containing formulas,...
sinatra: Reflected File Download attack
A flaw was found in Sinatra, a domain-specific language for creating web applications in Ruby. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input...
sinatra: Reflected File Download attack
A flaw was found in Sinatra, a domain-specific language for creating web applications in Ruby. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input...