An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of t...
AFFECTED_PRODUCTS:
Red Hat Keycloak,
Red Hat Openshift Container Platform,
Red Hat Openshift Container Platform
... (+5)
Hono is a web framework written in TypeScript. Prior to version 3.11.7, clients may override named path parameter values from previous requests if the application is using TrieRouter. So, there is a risk that a privileged user may use unintended parameters when deleting REST API resources. TrieRoute...
AFFECTED_PRODUCTS:
Hono Hono
Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform...
AFFECTED_PRODUCTS:
Squid-Cache Squid,
Squid-Cache Squid,
Squid-Cache Squid
... (+1)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andreas Münch Multiple Post Passwords allows Stored XSS.This issue affects Multiple Post Passwords: from n/a through 1.1.1.
AFFECTED_PRODUCTS:
Andreasmuench Multiple Post Passwords
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Labs64 Credit Tracker allows Stored XSS.This issue affects Credit Tracker: from n/a through 1.1.17.
AFFECTED_PRODUCTS:
Labs64 Credit Tracker
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Calendar Simple Calendar – Google Calendar Plugin allows Stored XSS.This issue affects Simple Calendar – Google Calendar Plugin: from n/a through 3.2.6.
AFFECTED_PRODUCTS:
Sureswiftcapital Simple Calendar
A vulnerability exists in the webserver that affects the
RTU500 series product versions listed below. A malicious
actor could perform cross-site scripting on the webserver
due to user input being improperly sanitized.
AFFECTED_PRODUCTS:
Hitachienergy Rtu520 Firmware,
Hitachienergy Rtu520 Firmware,
Hitachienergy Rtu520 Firmware
... (+25)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts allows Stored XSS.This issue affects WP Project Manager – Task, team, and project manage...
AFFECTED_PRODUCTS:
Wedevs Wp Project Manager
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpexpertsio Rocket Maintenance Mode & Coming Soon Page allows Stored XSS.This issue affects Rocket Maintenance Mode & Coming Soon Page: from n/a through 4.3.
AFFECTED_PRODUCTS:
Wpexperts Rocket Maintenance Mode \& Coming Soon Page
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.1.
AFFECTED_PRODUCTS:
Currencyratetoday Crypto Converter Widget
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CurrencyRate.Today Currency Converter Calculator allows Stored XSS.This issue affects Currency Converter Calculator: from n/a through 1.3.1.
AFFECTED_PRODUCTS:
Currencyratetoday Currency Converter Calculator
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnigmaWeb WP Catalogue allows Stored XSS.This issue affects WP Catalogue: from n/a through 1.7.6.
AFFECTED_PRODUCTS:
Maevelander Wp Catalogue
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bruno "Aesqe" Babic File Gallery allows Reflected XSS.This issue affects File Gallery: from n/a through 1.8.5.4.
AFFECTED_PRODUCTS:
Skyphe File Gallery
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nima Saberi Aparat allows Stored XSS.This issue affects Aparat: from n/a through 1.7.1.
AFFECTED_PRODUCTS:
Uxdev Aparat
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raghu Goriya MyTube PlayList allows Reflected XSS.This issue affects MyTube PlayList: from n/a through 2.0.3.
AFFECTED_PRODUCTS:
Tes-India Mytube Playlist
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor allows Reflected XSS.This issue affects JetBlocks For Elementor: from n/a through 1.3.8.
AFFECTED_PRODUCTS:
Motopress Jetblocks For Elementor
Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. A remote attacker could potentially exploit this vulnerability leading to obtain sensitive information that may aid in further attacks.
AFFECTED_PRODUCTS:
Dell Powermax Os,
Dell Solutions Enabler Virtual Appliance,
Dell Unisphere For Powermax Virtual Appliance
Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request contains a connection string for privileged SQL Server database access, and xp_cmdshell can be enabled.
AFFECTED_PRODUCTS:
Dokmee Enterprise Content Management
Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit f57bd745b4cbed577ea654fad4701bea4d38b44c. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a mo...
AFFECTED_PRODUCTS:
Moonlight-Stream Moonlight,
Moonlight-Stream Moonlight,
Moonlight-Stream Moonlight
... (+8)
Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game...
AFFECTED_PRODUCTS:
Moonlight-Stream Moonlight,
Moonlight-Stream Moonlight,
Moonlight-Stream Moonlight
... (+6)
Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game...
AFFECTED_PRODUCTS:
Moonlight-Stream Moonlight,
Moonlight-Stream Moonlight,
Moonlight-Stream Moonlight
... (+6)
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate ancillary credential information stored within WhatsUp Gold.
AFFECTED_PRODUCTS:
Progress WhatsUp Gold
In WhatsUp Gold versions released before 2023.1, an API endpoint was found to be missing an authentication mechanism. It is possible for an unauthenticated attacker to enumerate information related to a registered device being monitored by WhatsUp Gold.
AFFECTED_PRODUCTS:
Progress WhatsUp Gold
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Roles. Â
If a WhatsUp Gold user interacts with the crafted payload, the attacker would be able...
AFFECTED_PRODUCTS:
Progress WhatsUp Gold
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within Alert Center. Â
If a WhatsUp Gold user interacts with the crafted payload, the attacker would b...
AFFECTED_PRODUCTS:
Progress WhatsUp Gold
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a device group. Â
If a WhatsUp Gold user interacts with the crafted payload, the attacker would...
AFFECTED_PRODUCTS:
Progress WhatsUp Gold
In WhatsUp Gold versions released before 2023.1, a stored cross-site scripting (XSS) vulnerability has been identified. It is possible for an attacker to craft a XSS payload and store that value within a dashboard component. Â
If a WhatsUp Gold user interacts with the crafted payload, the attacker...
AFFECTED_PRODUCTS:
Progress WhatsUp Gold
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.
AFFECTED_PRODUCTS:
Jfinalcms Project Jfinalcms
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).
AFFECTED_PRODUCTS:
Jfinalcms Project Jfinalcms
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.
AFFECTED_PRODUCTS:
Jfinalcms Project Jfinalcms
JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.
AFFECTED_PRODUCTS:
Jfinalcms Project Jfinalcms
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress allows Stored XSS.This issue affects Optin Forms – Simple List Building Plugin for WordPress: from n/a through 1.3.3.
AFFECTED_PRODUCTS:
Fancythemes Optin Forms
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD) #wpsc allows Stored XSS.This issue affects Structured Content (JSON-LD) #wpsc: from n/a through 1.5.3.
AFFECTED_PRODUCTS:
Wpsc-Plugin Structured Content
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.
AFFECTED_PRODUCTS:
Wp Photo Album Plus Project Wp Photo Album Plus
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Link Log] allows Reflected XSS.This issue affects Smart External Link Click Monitor [Link Log]: from n/a through 5.0.2.
AFFECTED_PRODUCTS:
Petersplugins Link Log
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Peter Raschendorfer Smart External Link Click Monitor [Link Log] allows Stored XSS.This issue affects Smart External Link Click Monitor [Link Log]: from n/a through 5.0.2.
AFFECTED_PRODUCTS:
Petersplugins Smart External Link Click Monitor \[link Log\]
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Ultimate Addons for Contact Form 7 allows Stored XSS.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.2.0.
AFFECTED_PRODUCTS:
Themefic Ultimate Addons For Contact Form 7
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages allows Stored XSS.This issue affects Nested Pages: from n/a through 3.2.6.
AFFECTED_PRODUCTS:
Kylephillips Nested Pages
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10to8 Sign In Scheduling Online Appointment Booking System allows Stored XSS.This issue affects Sign In Scheduling Online Appointment Booking System: from n/a through 1.0.9.
AFFECTED_PRODUCTS:
10To8 Sign In Scheduling Online Appointment Booking System
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BrainCert BrainCert – HTML5 Virtual Classroom allows Reflected XSS.This issue affects BrainCert – HTML5 Virtual Classroom: from n/a through 1.30.
AFFECTED_PRODUCTS:
Braincert Virtual Classroom Api
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs Innovs HR – Complete Human Resource Management System for Your Business allows Reflected XSS.This issue affects Innovs HR – Complete Human Resource Management System for Your Business: fro...
AFFECTED_PRODUCTS:
Theinnovs Innovs Hr
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerability in an admin operation. A local high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on...
AFFECTED_PRODUCTS:
Dell Powerprotect Data Domain Management Center,
Dell Powerprotect Data Domain Management Center,
Dell Powerprotect Data Domain Management Center
... (+1)
Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the appl...
AFFECTED_PRODUCTS:
Dell Emc Data Domain Os,
Dell Emc Data Domain Os,
Dell Emc Data Domain Os
... (+10)
Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system.
AFFECTED_PRODUCTS:
Dell Powermax Os,
Dell Solutions Enabler Virtual Appliance,
Dell Unisphere For Powermax Virtual Appliance
Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system.
AFFECTED_PRODUCTS:
Dell Powermax Os,
Dell Solutions Enabler Virtual Appliance,
Dell Unisphere For Powermax Virtual Appliance
Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system.
AFFECTED_PRODUCTS:
Dell Powermax Os,
Dell Solutions Enabler Virtual Appliance,
Dell Unisphere For Powermax Virtual Appliance
Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system.
AFFECTED_PRODUCTS:
Dell Powermax Os,
Dell Solutions Enabler Virtual Appliance,
Dell Unisphere For Powermax Virtual Appliance
Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability to read arbitrary files from the target system.
AFFECTED_PRODUCTS:
Dell Powermax Os,
Dell Solutions Enabler Virtual Appliance,
Dell Unisphere For Powermax Virtual Appliance
Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. A remote attacker could potentially exploit this vulnerability to read arbitrary files from the target system.
AFFECTED_PRODUCTS:
Dell Powermax Os,
Dell Solutions Enabler Virtual Appliance,
Dell Unisphere For Powermax Virtual Appliance
Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the injection of malicious HTML or JavaScript code to a victi...
AFFECTED_PRODUCTS:
Dell Emc Data Domain Os,
Dell Emc Data Domain Os,
Dell Emc Data Domain Os
... (+10)