1936 matches found
Security Bulletin: Netty security vulnerabilities on IBM Watson Machine Learning Server
Summary Netty is vulnerable to allow HTTP Request Smuggling on IBM Watson Machine Learning Server Vulnerability Details CVEID: CVE-2020-7238 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by a flaw when handling Transfer-Encoding whitespace and a later Content-Length header. B...
Dart Cross-Site Scripting Vulnerability (CNVD-2021-31987)
Dart is an open source programming language. A cross-site scripting vulnerability exists in Dart SDK versions prior to 2.12.3, which can be exploited by attackers to use XSS attacks by hitting the DOM hard...
Jamovi Cross-Site Scripting Vulnerability
jamovi is jamovi open source a free and open statistics platform. Jamovi has a cross-site scripting vulnerability in version 1.6.18 and earlier. In ElectronJS framework , the listing is vulnerable to XSS attacks. An attacker can exploit the vulnerability to craft a .omv document containing a...
Consul -- Multiple vulnerabilities
Hashicorp reports: Add content-type headers to raw KV responses to prevent XSS attacks CVE-2020-25864. audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log CVE-2021-28156...
CVE-2021-24168 Easy Contact Form Pro < 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS)
The Easy Contact Form Pro WordPress plugin before 1.1.1.9 did not properly sanitise the text fields such as Email Subject, Email Recipient, etc when creating or editing a form, leading to an authenticated author+ stored cross-site scripting issue. This could allow medium privilege accounts such a...
Cross site scripting
SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page...
Cross-site Scripting (XSS)
spoon/library is vulnerable to cross-site scripting XSS attacks. A specifically crafted string injected through form attribute placeholders allows remote attackers to execute malicious scripts...
USN-4442-2: Sympa vulnerabilities
USN-4442-1 fixed vulnerabilities in Sympa. This update provides the corresponding updates for Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. Original advisory details: Nicolas Chatelain discovered that Sympa incorrectly handled environment variables. An attacker could possibly use this...
Updated ceph packages fix security vulnerabilities
A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard with passwords visible. The highest threat from this vulnerability is to confidentiality CVE-2020-25678. A flaw was found in ceph-dashboard. T...
[20210401] - Core - Escape xss in logo parameter error pages
Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error pages...
MDaemon Webmail Cross-Site Scripting Vulnerability (CNVD-2021-14734)
MDaemon Webmail is a server-side application for providing mail services from MDaemon, Inc. in the United States. A cross-site scripting vulnerability exists in MDaemon webmail 19.5.5, which allows attackers to execute code and XSS attacks while opening a contact list...
CVE-2021-20220
CVE-2021-20220 relates to Undertow. A regression in the fix for CVE-2020-10687 enables HTTP request smuggling in Undertow when processing HTTP/1.x and HTTP/2 traffic due to invalid characters in the request line. The vulnerability can allow an attacker to poison a web-cache, perform an XSS attack...
Huawei EulerOS: Security Advisory for python-lxml (EulerOS-SA-2021-1352)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Pi-hole Web Interface < 5.4 Multiple Vulnerabilities
The Pi-hole Web Interface previously AdminLTE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Joomla 3.0.x < 3.9.24 Multiple Vulnerabilities (5830-joomla-3-9-24)
According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 3.9.24. It is, therefore, affected by multiple vulnerabilities. - An issue was discovered in Joomla! 3.0.0 through 3.9.23. The lack of ACL checks in the orderPosition endpoint of...
CVE-2020-8280
A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting XSS attacks...
CVE-2020-35741
HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks...
CVE-2020-35740
HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks...