golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

GHSA-69CH-W2M2-3VJP golang.org/x/text/language Denial of service via crafted Accept-Language header

The BCP 47 tag parser has quadratic time complexity due to inherent aspects of its design. Since the parser is, by design, exposed to untrusted user input, this can be leveraged to force a program to consume significant time parsing Accept-Language headers. The parser cannot be easily rewritten t...

SAP Enable Now Cross-Site Scripting Vulnerability

SAP Enable Now is a collaborative content creation, management and sharing platform from SAP. The platform is primarily used for e-learning and training in SAP and non-SAP systems. A cross-site scripting vulnerability exists in SAP Enable Now 10 version 1. The vulnerability stems from failure to...

Apache Commons JXPath buffer overflow vulnerability

Apache Commons JXPath is a Java-based implementation of XPath 1.0 from the Apache Foundation in the U.S. A buffer overflow vulnerability exists in Apache Commons JXPath, which stems from a parser running on user-supplied input allowing an attacker to submit special data causing a stack overflow t...

CVE-2022-20423

In rndissetresponse of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious USB device is attached with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

PT-2022-26323 · Unknown · Student Clearance System

Name of the Vulnerable Software and Affected Versions: Student Clearance System version 1.0 Description: A Stored XSS issue allows the injection of arbitrary JavaScript in the Student registration form. Recommendations: For version 1.0, update the Student registration form to properly sanitize us...

rdiffweb vulnerable to Open Redirect

A lack of user input validation leads to an open redirect vulnerability in rdiffweb prior to 2.5.0a4...

ASUS RT-AX56U Buffer Overflow Vulnerability

ASUS RT-AX56U is a wireless router from ASUS, China.ASUS RT-AX56U Router firmware version 3.0.0.4.386.44266 has a buffer overflow vulnerability, which stems from the strcat function's lack of length checks for user input data, which can be exploited by attackers to remotely execute commands...

CVE-2022-32590

In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07299425; Issue ID: ALPS07299425...

[20221002] - Core - RXSS through reflection of user input in headings

Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in various components...

JXPath Out-of-bounds Write vulnerability

Withdrawn This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. Original Description Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

GHSA-C7MC-Q43H-5672 JXPath Out-of-bounds Write vulnerability

Withdrawn This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. Original Description Those using JXPath to interpret XPath may be vulnerable to Denial of Service attacks DOS. If the parser is running on user...

PT-2022-25253 · Jxpath · Jxpath

Name of the Vulnerable Software and Affected Versions: JXPath affected versions not specified Description: The issue concerns a potential Denial of Service DOS attack when using JXPath to interpret XPath. If the parser processes user-supplied input, an attacker could provide content that causes t...

PT-2022-25252 · Jxpath · Jxpath

Name of the Vulnerable Software and Affected Versions: JXPath affected versions not specified Description: The issue allows for Denial of Service attacks. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash by stackoverflow, potentially...

Apache Commons JXPath 缓冲区错误漏洞

Apache Commons JXPath is a Java-based implementation of XPath 1.0 from the Apache Foundation. Apache Commons JXPath suffers from a buffer error vulnerability that stems from a parser running on user-supplied input that allows an attacker to submit special data resulting in a denial of service due...

PT-2022-25255 · Apache · Jxpath

Name of the Vulnerable Software and Affected Versions: JXPath affected versions not specified Description: The issue allows for Denial of Service attacks if the parser is running on user-supplied input. An attacker may supply content that causes the parser to crash by stackoverflow, potentially...

Cisco BroadWorks Hosted Thin Receptionist Cross-Site Scripting Vulnerability

A vulnerability in the web management interface of Cisco BroadWorks Hosted Thin Receptionist could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient user input validation. An attacker cou...

Cross-site Scripting (XSS)

moodle is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to a lack of sanitization of user input to a recursive lambda function rendering to the Mustache template helper renderer allowing an attacker to inject maliciously crafted script into the system...

Moodle Stored Cross-site Scripting and page denial of service

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an Cross-site Scripting risk or a page failing to load...

GHSA-JQGR-GH62-JF53 Moodle Stored Cross-site Scripting and page denial of service

Recursive rendering of Mustache template helpers containing user input could, in some cases, result in an Cross-site Scripting risk or a page failing to load...