Threats Tagged 'cwe-94'

Nexus Repository 3 contains a vulnerability where the DataStore configuration API does not sufficiently restrict which HikariCP connection-pool properties can be set. A user with the nx-datastores-update permission can set the connectionInitSql property to execute arbitrary SQL on every new database connection. When using the default H2 database backend, this flaw can lead to remote code execution as the Nexus process user.

A cross-site scripting (XSS) vulnerability exists in SourceCodester Photo Share Website 1.0 within the Comment Input Box component, specifically in the /social/ajax.php?action=save_upload file. The vulnerability arises from improper handling of the 'content' argument, allowing remote attackers to inject malicious scripts. The vulnerability has a low severity score and requires user interaction to exploit.

Nexus Repository 3 did not sufficiently restrict which HikariCP connection-pool properties could be set through the DataStore configuration API. A user holding the nx-datastores-update permission could set the connectionInitSql property to execute arbitrary SQL against the configured database on every new connection. On the default H2 database backend, this could be leveraged to achieve remote code execution as the Nexus process user.

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2. This impacts an unknown function. Such manipulation leads to code injection. The attack needs to be performed locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text can inject arbitrary CSS into the rendered page, potentially altering the appearance or behavior of unrelated page elements. This issue is fixed in versions 10.9.8 and 11.16.1.

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file (`test/test.ts`) by interpolating user-supplied `opts.name` (ERC20/ERC721) and `opts.uri` (ERC1155) directly into TypeScript string literals at `zip-hardhat.ts:48` and `:50` without any JavaScript string escaping. No authentication is required: an attacker crafts a URL such as `https[:]//wizard[.]openzeppelin[.]com/#/erc20?name=");require("child_process").execSync("...");("` and shares it with a developer. When the victim downloads the resulting zip archive and runs `npx hardhat test`, the injected Node.js code executes with the developer's local OS privileges. Version 0.10.9 fixes the issue.

A cross-site scripting (XSS) vulnerability exists in the ttttonyhe OBlog software affecting the /tags.php file via manipulation of the 'day' argument. The vulnerability can be exploited remotely and requires user interaction. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The vendor has not responded to the disclosure. The CVSS score is 4.3, indicating a low severity issue.

Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.