Cross site scripting

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44380

Snipe-IT prior to version 6.0.14 is affected by a Cross Site Scripting (XSS) vulnerability when viewing assigned assets. The issue is documented across multiple feeds (CVE-2022-44380) and is addressed by upgrading to Snipe-IT 6.0.14 or later, per Red Hat advisory and NCSC release notes indicating...

CVE-2022-44380: Improper Neutralization of Input During Web Page Generation

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

PT-2022-7106 · Ibm · Ibm Navigator For I

Name of the Vulnerable Software and Affected Versions: IBM Navigator for i versions 7.3 through 7.5 Description: The issue is related to the lack of protection for the SQL query structure in the IBM Navigator graphical interface of the IBM i operating system. This could allow a remote attacker to...

CVE-2022-47928: Improper Neutralization of Input During Web Page Generation

In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/uploadfile.ctp...

IBM Navigator for i SQL注入漏洞

IBM Navigator for i is a console interface used in IBMi by International Business Machines IBM to perform and manage critical tasks in IBMi. IBM Navigator for i is vulnerable to SQL injection in versions 7.3, 7.4, and 7.5. The vulnerability stems from the application's lack of validation of...

Stored XSS in Week View Plugin

Description Stored cross-site scripting vulnerabilities arise when user input is stored and later embedded into the application's responses in an unsafe way. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of an...

CVE-2022-46122

Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/viewcategory.php?id=...

CVE-2022-46120

Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/viewproduct&id=...

CVE-2022-46117

Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=viewproduct&id=...

CVE-2022-23520 rails-html-sanitizer contains an incomplete fix for an XSS vulnerability

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to...

PT-2022-27742 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue concerns a SQL Injection vulnerability. It can be exploited via the "/hss/?page=view product&id=" API endpoint, specifically through the id variable. There is no information provid...

Helmet Store Showroom Site SQL注入漏洞

Helmet Store Showroom Site is a platform by Carlo Montero Personal Developer. It allows potential customers of Inquiries Stores to virtually display helmet products. A security vulnerability exists in Helmet Store Showroom Site v1.0, which stems from an SQL injection vulnerability via...

Helmet Store Showroom Site SQL注入漏洞

Helmet Store Showroom Site is a platform by Carlo Montero Personal Developer. It allows potential customers of Inquiries Stores to virtually display helmet products. A security vulnerability exists in Helmet Store Showroom Site v1.0, which stems from an SQL injection vulnerability via...

PT-2022-28057 · Unknown · Fp Masterquiz

Name of the Vulnerable Software and Affected Versions: fp masterquiz extension versions 2.2.0 and earlier, 3.x before 3.5.1 Description: An issue allows an attacker to continue the quiz of a different user, enabling them to view and modify that user's answers. Recommendations: For fp masterquiz...

PT-2022-27746 · Unknown · Helmet Store Showroom Site

Name of the Vulnerable Software and Affected Versions: Helmet Store Showroom Site version 1.0 Description: The issue is related to SQL Injection, which can be exploited via the "/hss/admin/?page=products/view product&id=" endpoint. The id variable is vulnerable to injection attacks...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 fpmasterquiz, which stems from the fact that an attacker can view the answers of this user and modify those answers...

CVE-2022-47407: Improper Access Control

An issue was discovered in the fpmasterquiz aka Master-Quiz extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers...