CVE-2023-32536

Affected versions Trend Micro Apex Central on-premise are vulnerable to potential authenticated reflected cross-site scripting XSS attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order ...

CVE-2023-32536

Affected versions Trend Micro Apex Central on-premise are vulnerable to potential authenticated reflected cross-site scripting XSS attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order ...

Acronis: [oem.acronis.com] Reflected Cross Site Scripting

The researcher discovered a reflected cross-site scripting XSS vulnerability on the oem.acronis.com website. The vulnerability was found on the /test/testenv.html page, where user-supplied input was not properly sanitized, allowing the execution of arbitrary JavaScript code...

Cross-Site Scripting (XSS)

tpwd/kesearch is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly validate user input before it output to the front end, allowing an attacker to inject and execute malicious javascript on victim's browser via indexed data...

fief-server Server-Side Template Injection vulnerability

Server-Side Template Injection Overview of the Vulnerability Server-Side Template Injection SSTI is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed. An attacker can use SSTI to...

GHSA-HJ8M-9FHF-V7JP fief-server Server-Side Template Injection vulnerability

Server-Side Template Injection Overview of the Vulnerability Server-Side Template Injection SSTI is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed. An attacker can use SSTI to...

jcvi vulnerable to Configuration Injection due to unsanitized user input

Summary A configuration injection happens when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that may lead to a command injection. PoC The vulnerable code snippet is...

PT-2023-25390

Name of the Vulnerable Software and Affected Versions jcvi affected versions not specified Description A configuration injection occurs when user input is considered by the application in an unsanitized format and can reach the configuration file. A malicious user may craft a special payload that...

CVE-2023-31868

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

CVE-2023-31868

Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting XSS. Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is...

Ubuntu: Security Advisory (USN-6181-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Sql injection

Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection SQLI attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process...

CVE-2023-33584

Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection SQLI attacks, which allow an attacker to manipulate the SQL queries executed by the application. The application fails to properly validate user-supplied input in the username and password fields during the login process...

Cross-Site Scripting (XSS)

github.com/gitpod-io/gitpod is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly check for user input URLs which leads to redirection for some protocols outside of the trusted set of three vscode: vscode-insiders: jetbrains-gateway:, allowing an attacker to execute...

Cross-Site Scripting (XSS)

admidio/admidio is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of user input sanitization in this library. which allows an attacker to inject and execute arbitrary JavaScript into the browser...

PT-2023-3405 · NetGear · Netgear R6250

Name of the Vulnerable Software and Affected Versions: Netgear R6250 Firmware Version 1.0.4.48 Description: The issue is related to a buffer overflow vulnerability in the Netgear R6250 router's firmware. This vulnerability is associated with uncontrolled copying of user input, which can lead to a...

CVE-2023-2399

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

CVE-2023-2399 qubotchat < 1.1.6 - Unauthenticated Stored XSS

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

CVE-2023-2399 qubotchat < 1.1.6 - Unauthenticated Stored XSS

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

ROS-20230619-02

A vulnerability in the Redis database is related to insufficient validation of user-entered data, a user could use the HINCRBYFLOAT command to create an invalid hash field. Exploitation of the vulnerability could allow an attacker acting remotely to cause Redis to crash when accessing the affecte...