CVE-2022-23057

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

Cross site scripting

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23057 ERPNext - Stored XSS in My Profile

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

CVE-2022-23057 ERPNext - Stored XSS in My Profile

In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting XSS, due to user input not being validated properly. A low privileged attacker could inject arbitrary code into input fields when editing his profile...

Command Injection

next-auth is vulnerable to command injection. The vulnerability exists in the assertConfig in assert.ts due to improper handling of user input which allows malicious attacker to inject and execute arbitrary commands...

PT-2022-20361 · Unknown · Nukeviet Cms

Name of the Vulnerable Software and Affected Versions: NukeViet CMS versions prior to 4.5.02 Description: The issue is related to a Cross Site Scripting Stored XSS vulnerability. This means that an attacker can inject malicious scripts into the website, which can then be executed by other users. ...

Cisco Catalyst 2940 Series Cross-Site Scripting Vulnerability

Cisco Catalyst is a series of switches from Cisco, Inc. A cross-site scripting vulnerability exists in the Cisco Catalyst 2940 Series, which stems from a failure to properly process user input and generate an error page that could be exploited by an attacker to execute arbitrary scripts on the we...

brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...

brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...

GHSA-7V4J-8WVR-V55R `array!` macro is unsound when its length is impure constant

Affected versions of this crate did substitute the array length provided by an user at compile-time multiple times. When an impure constant expression is passed as an array length such as a result of an impure procedural macro, this can result in the initialization of an array with uninitialized...

UBUNTU-CVE-2022-20166

In various methods of kernel base drivers, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndro...

CVE-2021-39691

In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

Design/Logic Flaw

In WindowManager, there is a possible tapjacking attack due to an incorrect window flag when processing user input. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10...

CVE-2022-25878

A flaw was found in protobufjs, where it is vulnerable to Prototype Pollution, allowing an attacker to add/modify properties of the Object.prototype. This vulnerability can occur by providing untrusted user input to the util.setProperty or to the ReflectionObject.setParsedOption functions, and al...

Directory traversal

SeedDMS 6.0.17 and 5.1.24 are vulnerable to Directory Traversal. The "Remove file" functionality inside the "Log files management" menu does not sanitize user input allowing attackers with admin privileges to delete arbitrary files on the remote system...

Google Android 权限许可和访问控制问题漏洞

Google Android is a Linux-based open-source operating system from the U.S. company Google Android has an elevation of privilege vulnerability that stems from a window flag error when processing user input, which could lead to an eavesdropping attack that could be exploited by an attacker to cause...

CVE-2022-29540

resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. Unauthenticated remote attackers can inject arbitrary web script or HTML into an HTTP GET parameter that reflects user input without sanitization. This exists on numerous application endpoints,...

Cross site scripting

resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. Unauthenticated remote attackers can inject arbitrary web script or HTML into an HTTP GET parameter that reflects user input without sanitization. This exists on numerous application endpoints,...

Stored XSS in Resources

Description Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Steps to reproduce it works on Firefox not in chromium based browsers 1.Go to https://www.rosariosis.org/demonstration/ and login with...

CVE-2021-43308 Exponential ReDoS in markdown-link-extractor

An exponential ReDoS Regular Expression Denial of Service can be triggered in the markdown-link-extractor npm package, when an attacker is able to supply arbitrary input to the module's exported function...