CVE-2022-48590

A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48583

A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...

Command injection

A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...

CVE-2022-48590

A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48589

A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48588

A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48587

A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...

CVE-2022-48582

A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...

PT-2023-15876 · Sciencelogic · Sciencelogic Sl1

Name of the Vulnerable Software and Affected Versions: ScienceLogic SL1 affected versions not specified Description: A SQL injection issue exists in the “logging export” feature, where unsanitized user-controlled input is passed directly to a SQL query, allowing the injection of arbitrary SQL...

PT-2023-15860 · Sciencelogic · Sciencelogic Sl1

Name of the Vulnerable Software and Affected Versions: ScienceLogic SL1 affected versions not specified Description: A SQL injection issue exists in the "schedule editor decoupled" feature, where unsanitized user-controlled input is passed directly to a SQL query, allowing the injection of...

CVE-2023-34623

A flaw was found in jtidy when parsing untrusted html. If the parser is running on unsanitized user input, an attacker could craft a request that causes the parser to crash by stack overflow, resulting in a denial of service DoS. Mitigation This flaw can be mitigated by implementing sanitization...

CVE-2023-3894

Those using jackson-dataformats-text to parse TOML data may be vulnerable to Denial of Service attacks DOS. If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack...

PT-2023-26697 · Unknown · Jackson-Dataformats-Text

Name of the Vulnerable Software and Affected Versions: jackson-dataformats-text affected versions not specified Description: The issue allows for Denial of Service attacks. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash by stack...

PT-2023-25606

Name of the Vulnerable Software and Affected Versions Digital Ant E-Commerce Software versions prior to 11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker c...

WPBulky < 1.0.10 - Contributor+ Stored Cross-Site Scripting

Description The plugin does not properly sanitize user input via its sanitize function, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross-site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of a validation user input in tagschema.go, which allows an attacker to inject and execute malicious Javascript into the browser...

Cross-site Scripting (XSS)

github.com/answerdev/answer is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of user input validation in tagschema.go, which allows an attacker to inject and execute malicious Javascript into the browser...

PT-2023-26569 · Npm · Import-In-The-Middle

Name of the Vulnerable Software and Affected Versions: import-in-the-middle versions prior to 1.4.2 Description: The import-in-the-middle loader works by generating a wrapper module on the fly, using the module specifier to load the original module and add some wrapping code. This allows for remo...

Improper Input Validation

chromium is vulnerable to Improper Input Validation. The vulnerability exists due to the lack of user input validation in the QUIC of the library, allowing an attacker to perform header splitting via malicious network traffic...

Open Redirect

gitlab is vulnerable to Open Redirect. The vulnerability exists due to the lack of sanitization in the user input URLs, which allows an attacker to redirect users to malicious locations...