Archive
1 September 2020
Vulnerabilities first published on this day (UTC), newest first.
192 results · Feed
-
High —
DOM-based XSS in gmail-js
Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor. ## Recommendation…
-
High —
Cross-Site Scripting in bootstrap-tagsinput
All versions of `bootstrap-tagsinput` are vulnerable to cross-site scripting when user input is passed into the `itemTitle` parameter unmodified, as the package fails to properly sanitize or encode user input for that parameter. ## Recommendation This package…
-
Critical —
Cross-Site Scripting in swagger-ui
Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API. Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the qu…
-
Critical 9.8
SQL Injection via GeoJSON in sequelize
Affected versions of `sequelize` are vulnerable to SQL Injection in Models that have fields with the `GEOMETRY` DataType. This vulnerability occurs because single quotes in document values are not escaped for GeoJSON documents using `ST_GeomFromGeoJSON`, and …
-
Medium 4.2
Insecure Defaults Leads to Potential MITM in ezseed-transmission
Affected versions of `ezseed-transmission` download and run a script over an HTTP connection. An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromis…
-
Medium 6.3
Template Injection in jsrender
Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input. ## Proof of Concept ```js //POC-REQUEST {{for ~x!=1?(constructor.constructor("ret…
-
High 8.7
Forgeable Public/Private Tokens in jws
Affected versions of the `jws` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use…
-
Critical —
Command Injection in gm
Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary. ## Recommendati…
-
Medium 5.3
Regular Expression Denial of Service in bleach
All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function. ## Recommendation The `bleach` package is not currently maintained, and has not seen an upd…
-
High 7.5
Denial of Service in yar
Versions of `yar` prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value. When an invalid encryped session cookie value is provided, the process will crash. ## Recommendation Update to version 2.2…
-
Unscored —
Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XS…
-
Unscored —
gmapfp.org Joomla Component GMapFP J3.30pro is affected by Insecure Permissions. An attacker can access the upload func…
-
High 7.5
Rapid7 Metasploit HTTP Handler Denial of Service
By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established…
-
Medium 6.4
SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page MassD…
-
Medium 6.4
SQL injection vulnerabilities exist in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page Cours…
-
Medium 6.4
SQL injection vulnerability exists in the ID parameters of OS4Ed openSIS 7.3 pages. The id parameter in the page Choose…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. A specially crafted HTTP req…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The id parameter in the page…
-
Medium 6.4
SQL injection vulnerability exists in the CoursePeriodModal.php page of OS4Ed openSIS 7.3. The course_period_id paramet…
-
Medium 6.4
An exploitable SQL injection vulnerability exists in the GetSchool.php functionality of OS4Ed openSIS 7.3. A specially …
-
Medium 6.4
An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email …
-
Medium 6.4
An exploitable sql injection vulnerability exists in the email parameter functionality of OS4Ed openSIS 7.3. The email …
-
Medium 4.3
Trailer Power Line Communications vulnerability
All trailer Power Line Communications are affected. PLC bus traffic can be sniffed reliably via an active antenna up to 6 feet away. Further distances are also possible, subject to environmental conditions and receiver improvements.
-
Medium 6.4
SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The mn parameter in the …
-
Medium 6.4
SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The ln parameter in the…
-
Medium 6.4
SQL injection vulnerability exists in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The fn parameter in the …
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/tarutil. It is vulnerable to both leading and non-leading relative path traversal attacks in tar file extraction.
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/cpio. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based (relative and absolute) path traversal attacks in cpio file extraction.
-
High 7.5
Arbitrary File Write via Archive Extraction (Zip Slip)
This affects all versions of package github.com/u-root/u-root/pkg/uzip. It is vulnerable to both leading and non-leading relative path traversal attacks in zip file extraction.
-
Medium 6.4
SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The byear parameter in …
-
Medium 6.4
SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bmonth parameter in…
-
Medium 6.4
SQL injection vulnerabilities exist in the CheckDuplicateStudent.php page of OS4Ed openSIS 7.3. The bday parameter in t…
-
Medium 4.3
Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin
Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file s…
-
Low 3.3
Credentials stored in plain text by Jenkins tfs Plugin
Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
-
Medium 4.3
Passwords transmitted in plain text by Jenkins ReadyAPI Functional Testing Plugin
Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
-
High 8.8
Reflected XSS vulnerability in Jenkins JSGames Plugin
Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.
-
High 7.1
XXE vulnerability in Jenkins Klocwork Analysis Plugin
Jenkins Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
High 7.1
XXE vulnerability in Jenkins Valgrind Plugin
Jenkins Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
-
High 8.0
Stored XSS vulnerability in Jenkins Valgrind Plugin
Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents.
-
High 8.0
Stored XSS vulnerability in Jenkins Cadence vManager Plugin
Jenkins Cadence vManager Plugin 3.0.4 and earlier does not escape build descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.