GHSA-C86Q-RJ37-8F85 LibreNMS has a stored XSS in ExamplePlugin with Device's Notes

Summary The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code. Details User with Admin role can add Notes to a device, the application did not properly sanitize the user input, when the...

GHSA-R735-9GC6-2HVQ Cross-site Scripting (XSS) - DOM in janeczku/calibre-web

A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...

Cross-site Scripting (XSS) - DOM in janeczku/calibre-web

A Cross-site Scripting XSS vulnerability exists in janeczku/calibre-web, specifically in the file editbooks.js. The vulnerability occurs when editing book properties, such as uploading a cover or a format. The affected code directly inserts user input into the DOM without proper sanitization,...

OESA-2024-2378 woodstox-core security update

Woodstox is a high-performance validating namespace-aware StAX-compliant JSR-173 Open Source XML-processor written in Java. XML processor means that it handles both input == parsing and output == writing, serialization, as well as supporting tasks such as validation. Security Fixes: Those using...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2024-45434)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from International Business Machines IBM. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for...

PT-2025-8817

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A potential issue in the Linux kernel has been identified, related to the msm ioctl gem submit function. Specifically, the submit-cmdi.size and submit-cmdi.offset variables, which are u3...

CVE-2024-6068

The CVE-2024-6068 entry concerns Rockwell Automation Arena Input Analyzer. According to the provided documents, the vulnerability is a memory corruption flaw that occurs when parsing DFT files. Affected software is Rockwell Automation Input Analyzer (as included in Arena) around version 16.20.03;...

Reflected Cross-Site Scripting (Reflected XSS)

OctoPrint is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to unescaped user inputs in OctoPrint’s login dialog and standalone application key confirmation dialog, allows attackers to inject malicious scripts that get reflected back to the user's browser...

Cisco AsyncOS Cross-Site Scripting Vulnerability

Cisco AsyncOS is an operating system for Cisco devices from Cisco USA. Cisco AsyncOS suffers from a cross-site scripting vulnerability that stems from insufficient authentication of user input. An authenticated, remote attacker could exploit this vulnerability to launch a stored cross-site...

CVE-2024-21949

Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to system crash...

CVE-2023-32736

A vulnerability has been identified in SIMATIC S7-PLCSIM V16 All versions, SIMATIC S7-PLCSIM V17 All versions, SIMATIC STEP 7 Safety V16 All versions, SIMATIC STEP 7 Safety V17 All versions V17 Update 8, SIMATIC STEP 7 Safety V18 All versions V18 Update 5, SIMATIC STEP 7 V16 All versions, SIMATIC...

jinja2: accepts keys containing non-attribute characters

A flaw was found in jinja2. The xmlattr filter accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, /, , or =, as each would then be interpreted as starting a separate attribute. If an application accepts keys as opposed to only values as user input, and...

SQL Injection

@langchain/community is vulnerable to SQL injection. The vulnerability is due to improper handling of user input in the GraphCypherQAChain class, which allows attackers to inject malicious prompts that can lead to SQL injection...

CVE-2024-52286

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input file name and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code...

CVE-2024-52286

CVE-2024-52286 affects Stirling-PDF prior to 0.32.0. The Merge function uses untrusted file names directly in innerHTML (code starts at Line 24 in merge.js), enabling a self‑injection XSS where a user uploading a file with a crafted name can execute JavaScript in their own browser context. The vu...

CVE-2024-52286 Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF

Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge functionality takes untrusted user input file name and uses it directly in the creation of HTML pages allowing any unauthenticated to execute JavaScript code...

PT-2024-34843 · Unknown · Content Syndication Toolkit Reader

Name of the Vulnerable Software and Affected Versions: Content Syndication Toolkit Reader versions 1.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS, where an...

PT-2024-34754 · Miguel Peixe · Wp Feature Box

Name of the Vulnerable Software and Affected Versions: Miguel Peixe WP Feature Box versions 0.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows attackers to store harmful scripts,...

PT-2024-34732 · Unknown · Bigmart Elements

Name of the Vulnerable Software and Affected Versions: Bigmart Elements versions n/a through 1.0.3 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for DOM-Based XSS attacks. Recommendations: F...

CVE-2024-50811

hopetree izone lts c011b48 contains a server-side request forgery SSRF vulnerability in the active push function as \apps\tool\apis\bdpush.py does not securely filter user input through pushurls and geturls...