496 matches found
GHSA-3J7M-HMH3-9JMP Cross-Site Scripting in sanitize-html
Affected versions of sanitize-html do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript. Recommendation Update to version 1.4.3 or later...
node-mpv command injection vulnerability
node-mpv is a wrapper to use the mpv player for node.js. A command injection vulnerability exists in node-mpv 1.4.3 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands via the options parameter...
CVE-2020-6973
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 82002228K 08/09/2018, bios Version 1.2. Multiple cross-site scripting vulnerabilities exist that could allow an attacker to cause a denial-of-service condition...
Design/Logic Flaw
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 82002228K 08/09/2018, bios Version 1.2. Successful exploitation of this vulnerability could allow an attacker to upload a malicious file to the application...
CVE-2020-6973
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 82002228K 08/09/2018, bios Version 1.2. Multiple cross-site scripting vulnerabilities exist that could allow an attacker to cause a denial-of-service condition...
CVE-2020-6975
Digi International ConnectPort LTS 32 MEI, Firmware Version 1.4.3 82002228K 08/09/2018, bios Version 1.2. Successful exploitation of this vulnerability could allow an attacker to upload a malicious file to the application...
Digi ConnectPort LTS 32 MEI
1. EXECUTIVE SUMMARY CVSS v3 2.4 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Digi International Equipment : ConnectPort LTS 32 MEI Vulnerabilities : Unrestricted Upload of File with Dangerous Type, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these...
CVE-2020-5236
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
PYSEC-2020-155
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
CVE-2020-5236
Waitress version 1.4.2 allows a DOS attack When waitress receives a header that contains invalid characters. When a header like "Bad-header: xxxxxxxxxxxxxxx\x10" is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use 100% CPU time and...
Cross site scripting
sanitize-html before 1.4.3 has XSS...
WallacePOS Code Issue Vulnerability
WallacePOS is a web-based open source point of sale and retail management system. A code issue vulnerability exists in WallacePOS 1.4.3, which can be exploited by a remote authenticated attacker to execute arbitrary code by uploading a malicious PHP file...
WallacePOS Cross-Site Request Forgery Vulnerability
WallacePOS is an open source, web-based POS and business management system. The system is compatible with standard POS hardware such as receipt printers, cash drawers and barcode scanners. A cross-site request forgery vulnerability exists in WallacePOS version 1.4.3. The vulnerability stems from...
WallacePOS Cross-Site Scripting Vulnerability (CNVD-2019-25985)
WallacePOS is an open source, web-based POS and business management system. The system is compatible with standard POS hardware such as receipt printers, cash drawers and barcode scanners. A cross-site scripting vulnerability exists in WallacePOS version 1.4.3. The vulnerability stems from the WE...
NETGEAR ReadyNAS Surveillance Command Injection Vulnerability
NETGEAR ReadyNAS Surveillance is an add-on application for NETGEAR ReadyNAS from NETGEAR. The program extends surveillance video management capabilities for NETGEAR ReadyNAS devices. A command injection vulnerability exists in NETGEAR ReadyNAS Surveillance versions prior to 1.4.3-17 x86 and prior...
libssh2 security update
1.4.3-12.0.1.el76.2 - Orabug: 29909723 Added patch CVE-2019-3862 added length checks to prevent out-of-bounds reads and writes in libssh2packetaddCVE-2019-3862...
libssh2 security update
1.4.3-12.el76.2 - sanitize public header file detected by rpmdiff 1.4.3-12.el76.1 - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes CVE-2019-3863 - fix integer overflow in SSH packet processing channel resulting in out of bounds write CVE-2019-3857 - fix...
PT-2019-19855 · Hashicorp +1 · Hashicorp Consul +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul version 1.4.3 Description: The issue arises from a lack of server hostname verification for agent-to-agent TLS communication in HashiCorp Consul. This occurs even when the verify server hostname setting is set to true, causin...
PT-2019-18973 · Hashicorp +1 · Hashicorp Consul +2
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul and Consul Enterprise versions 1.4.0 through 1.4.2 Description: The issue allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters. This occurs...