Improper Input Validation

Contao is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation and sanitization of user input in the canonical tag, allowing untrusted users to inject insert tags that are then rendered on the web page...

Cross Site Scripting(XSS)

wireui/wireui is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper sanitization or escaping of user input in the label query parameter of the /wireui/button endpoint, which allows malicious actors to inject JavaScript and execute arbitrary code in the victim's...

Prototype Pollution

@backstage/plugin-catalog-backend is vulnerable to Prototype Pollution. The vulnerability is caused due to improper user input sanitization in the catalog API, which allows an attacker to interrupt the service using a specially crafted query...

AZL-49572 CVE-2024-46759 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: hwmon: adc128d818 Fix underflows seen when writing limit attributes DIVROUNDCLOSEST after kstrtol results in an underflow if a large negative number such as -9223372036854775808 is provided by the user. Fix it by reordering...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from not properly handling user input...

GHSA-RW5H-G8XQ-6877 Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content

Summary A potential Cross-Site Scripting XSS vulnerability has been identified in the /wireui/button endpoint, specifically through the label query parameter. Malicious actors could exploit this vulnerability by injecting JavaScript into the label parameter, leading to the execution of arbitrary...

Wire UI has a JS XSS Vulnerability on route /wireui/button?label=Content

Summary A potential Cross-Site Scripting XSS vulnerability has been identified in the /wireui/button endpoint, specifically through the label query parameter. Malicious actors could exploit this vulnerability by injecting JavaScript into the label parameter, leading to the execution of arbitrary...

CVE-2024-38380 Millbeck Communications Proroute H685t-w Cross-site Scripting.

This vulnerability occurs when user-supplied input is improperly sanitized and then reflected back to the user's browser, allowing an attacker to execute arbitrary JavaScript in the context of the victim's browser session...

CVE-2024-38380

Confirmed CVE-2024-38380 relates to Millbeck Communications Proroute H685t-w (firmware 3.2.334). Affected component: web UI endpoints (vpn/openconnect_client.lua, vpn/pptp_edit.lua, filebrowser) where user input is improperly sanitized and reflected, enabling: 1) Command injection via vulnerable ...

CVE-2024-8778 The SYSCOM Group OMFLOW - Arbitrary File Read

OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files...

CVE-2024-5931

BT: Unchecked user input in bapbroadcastassistant...

CVE-2024-5931

BT: Unchecked user input in bapbroadcastassistant...

CVE-2024-5931

CVE-2024-5931 affects Zephyr RTOS, specifically the bap_broadcast_assistant component, due to unchecked user input. Public sources indicate affected version range includes Zephyr 3.6 and earlier; the underlying issue is improper input validation, with potential availability impact (per NVD CVSS: ...

CVE-2024-5931 BT: Unchecked user input in bap_broadcast_assistant

BT: Unchecked user input in bapbroadcastassistant...

Cross-site Scripting (XSS)

serve-static is vulnerable to Cross-site Scripting XSS. The vulnerability is due to passing untrusted user input, even after sanitization, to the redirect function, which may lead to the execution of untrusted code...

Remote Code Execution (RCE)

Express.js is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient validation or handling of user input when passed to response.redirect, allowing untrusted code to be executed despite sanitization efforts...

Remote Code Execution (RCE)

dtale is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling or validation of user input in the "Custom Filter" feature using the getstrarg method, allowing malicious code to be executed on the server...

CVE-2024-21529

Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the...

CVE-2024-21529

Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property proto, which is recursively assigned to all the...

Ivanti Endpoint Manager updateAssetInfo SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the updateAssetInfo method. The issue results from the lack of...