Froxlor prior to version 0.10.39 is vulnerable to Code Injection.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-3721
https://github.com/froxlor/froxlor/commit/1182453c18a83309a3470b2775c148ede740806c
https://huntr.dev/bounties/a3c506f0-5f8a-4ea…
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the __proto__ property to be edited.
Refere…
deep-object-diff before version 1.1.6 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the __proto__ property to be edited. Thi…
fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the __proto__ property to be edited.
Refe…
Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through Markdownify. This is possible because the application does not have a CSP policy (or at…
OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-37823
https://medium.com/@nowczj/sql-injection-exists-in-the-background-of-…
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a ‘”sampling”:{“value”:”
The TYPO3 Extension femanager prior to versions 5.5.2, 6.3.3, and 7.0.1 is vulnerable to broken access control. The usergroup.inList validation can be bypassed resulting in new frontend users created by the extension may be members of groups that are r…
A vulnerability has been found in Tribal Systems Zenario CMS prior to version 8.5.51340. Affected by this issue is some unknown functionality of the file admin_organizer.js of the component Error Log Module. The manipulation leads to cross site scripti…
In Apache Airflow versions prior to 2.4.2, the “Trigger DAG with config” screen was susceptible to XSS attacks via the origin query argument.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-43982
https://github.com/apache/airflow/pull/27143
https…
