CVE-2020-15366

An issue was discovered in ajv.validate in Ajv aka Another JSON Schema Validator 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. While untrusted schemas are recommended against, the worst case of an untrusted schema should be a...

Cross-Site Scripting (XSS)

haffner/jhcaptcha extension of Typo3 is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser using the TypoScript parameters in the ReCaptcha Validator and View Helper pages...

Cross-Site Scripting (XSS)

css-validator is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the URL when an error message is displayed...

CVE-2020-4070

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9...

CVE-2020-4070

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9...

Cross site scripting

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9...

CVE-2020-4070 Cross-site Scripting in CSS Validator

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9...

CVE-2020-4070

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9...

CVE-2020-4070

The CVE-2020-4070 issue affects the CSS Validator. The vulnerability is a cross-site scripting (XSS) flaw in how URIs are handled, triggered when a user clicks a specially crafted validator link. The problem is scoped to CSS Validator builds up to commit 54d68a1, and a patch was applied in commit...

CVE-2020-4070: Improper Neutralization of Input During Web Page Generation

In CSS Validator less than or equal to commit 54d68a1, there is a cross-site scripting vulnerability in handling URIs. A user would have to click on a specifically crafted validator link to trigger it. This has been patched in commit e5c09a9...

PT-2020-17860

Name of the Vulnerable Software and Affected Versions CSS Validator versions prior to commit e5c09a9 Description The issue is related to a cross-site scripting vulnerability in handling URIs. It can be triggered when a user clicks on a specifically crafted validator link. Recommendations For...

Server-Side Template Injection

conductor-core is vulnerable to server-side template injection. The vulnerability exists as it was using hibernate-validator in a custom constraint validator, where user-input that were not properly validated against a validation mapping configuration can reach the error message template, allowin...

Code injection

Netflix Titus uses Java Bean Validation JSR 380 custom constraint validators. When building custom constraint violation error messages, different types of interpolation are supported, including Java EL expressions. If an attacker can inject arbitrary data in the error message template being passe...

PT-2020-20571 · Netflix +1 · Netflix Titus +2

Name of the Vulnerable Software and Affected Versions: Netflix Titus affected versions not specified Netflix Conductor affected versions not specified Description: The issue concerns the use of Java Bean Validation JSR 380 custom constraint validators in Netflix Titus and Netflix Conductor. When...

am.ik.home:uaa-server (>=1.3.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +1879 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.3.0.final, <=5.3.5.final)

org.hibernate:hibernate-validator MAVEN version =5.3.0.final, =1.3.0, =0.9.6, =0.0.1, =0.2.0, =1.0.3, =1.0.6, =0.2.1, =1.0.1, =1.2, =1.5 and more Source cves: CVE-2017-7536 Source advisory: OSV:GHSA-XXGP-PCFC-3VGC...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), at.porscheinformatik.zanata:common (>=4.7.0, <=4.7.8) +2703 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.2.0.final, <=5.2.4.final)

org.hibernate:hibernate-validator MAVEN version =5.2.0.final, =1.0.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1, =1, =10 and more Source cves: CVE-2017-7536 Source advisory: GHSA-XXGP-PCFC-3VGC...

am.ik.home:uaa-server (>=1.3.0, <=1.9.0), au.com.cybernostics:theme-tree (0.9.0) +1879 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.3.0.final, <=5.3.5.final)

org.hibernate:hibernate-validator MAVEN version =5.3.0.final, =1.3.0, =0.9.6, =0.0.1, =0.2.0, =1.0.3, =1.0.6, =0.2.1, =1.0.1, =1.2, =1.5 and more Source cves: CVE-2017-7536 Source advisory: GHSA-XXGP-PCFC-3VGC...

am.ik.home:uaa-server (>=1.0.0, <=1.2.0), at.porscheinformatik.zanata:common (>=4.7.0, <=4.7.8) +2703 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.2.0.final, <=5.2.4.final)

org.hibernate:hibernate-validator MAVEN version =5.2.0.final, =1.0.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =4.7.0, =1, =1, =10 and more Source cves: CVE-2017-7536 Source advisory: OSV:GHSA-XXGP-PCFC-3VGC...

Privilege Escalation in Hibernate Validator

In Hibernate Validator 5.2.x before 5.2.5.Final, 5.3.x before 5.3.6.Final, and 5.4.x before 5.4.2.Final, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege...

at.researchstudio.sat:won-owner-webapp (0.3), at.yawk.dropwizard-nagios:dropwizard-nagios (1.0) +716 more potentially affected by CVE-2017-7536 via org.hibernate:hibernate-validator (>=5.4.0.final, <=5.4.1.final)

org.hibernate:hibernate-validator MAVEN version =5.4.0.final, =2.6.0, =2.6.0, =3.4.0, =3.6.0, =2.4, =3.5.0, =1.0.0.final, =2.5.4, =0.8.0, =0.9.2 - com.arpnetworking:artemis2.11 0.1.7 - com.bendb.dropwizard:dropwizard-jooq 1.2.0-0 and more Source cves: CVE-2017-7536 Source advisory:...