1597 matches found
Cross site scripting
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...
CVE-2019-16931
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...
CVE-2019-16931
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...
CVE-2019-16931: Improper Neutralization of Input During Web Page Generation
A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...
PT-2019-14877
Name of the Vulnerable Software and Affected Versions Visualizer plugin version 3.3.0 Description A stored XSS issue allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because the...
SUSE SLED15 / SLES15 Security Update : libreoffice (SUSE-SU-2019:2003-1)
This update for libreoffice fixes the following issues : LibreOffice was updated to 6.2.5.2 fate327121. Security issue fixed : CVE-2018-16858: LibreOffice was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craf...
CVE-2019-4118: Undefined Security Weakness
IBM Multicloud Manager 3.1.0, 3.1.1, and 3.1.2 ibm-mcm-chart could allow a local attacker with admin privileges to obtain highly sensitive information upon deployment. IBM X-Force ID: 158144...
Youzer - Fake User Generator For Active Directory Environments
Fake User Generator for Active Directory Environments Introduction The goal of Youzer is to create information rich Active Directory environments. This uses the python3 library 'faker' to generate random accounts. pip3 install faker You can either supply a wordlist or have the passwords generated...
Synology Office Cross-Site Scripting Vulnerability (CNVD-2019-20978)
Synology Office is a web-based office software system from Synology Inc. of Taiwan, China. The system features online document and spreadsheet creation, as well as importing local files. A cross-site scripting vulnerability exists in Chart in Synology Office versions prior to 3.1.4-2771. The...
CVE-2019-11828
Cross-site scripting XSS vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
CVE-2019-11828
Cross-site scripting XSS vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
CVE-2019-11828: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Chart in Synology Office before 3.1.4-2771 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
New Relic: Stored XSS via "my recent queries" selector in NRQL dashboard builder
This is a pretty simple one. Within NR One, there is a stored XSS via the dashboard builder. It appears in the "My recent queries" dropdown. You can attack other users with this bug by having them navigate to the link, I'll show an example below. Steps to Reproduce: 1. From NR1, navigate to the...
PT-2019-12685
Name of the Vulnerable Software and Affected Versions Boostnote version 0.11.15 Description The issue is related to a XSS in the browser/components/MarkdownPreview.js component. It can be triggered via a label named flowchart, sequence, gallery, or chart. A crafted SRC attribute of an IFRAME...
New Relic: Stored XSS firing at the "Add chart to note" popup
Hey team, I have long found that a request retrieving content for Add chart to note popup is XSS-vulnerable. The following Add to note popup F484252 retrieves its content via the following request: http GET...
PT-2019-12079 · Salicru · Slc-20-Cube3
Name of the Vulnerable Software and Affected Versions: Salicru SLC-20-cube35 devices running firmware version cs121-SNMP v4.54.82.130611 Description: A reflected HTML injection issue allows remote attackers to inject arbitrary HTML elements via specific API endpoints, including /DataLog.csv?log=,...
FreeBSD : Gitlab -- Multiple vulnerabilities (11292460-3f2f-11e9-adcb-001b217b3468)
Gitlab reports : Arbitrary file read via MergeRequestDiff CSRF add Kubernetes cluster integration Blind SSRF in prometheus integration Merge request information disclosure IDOR milestone name information disclosure Burndown chart information disclosure Private merge request titles in public proje...
Design/Logic Flaw
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard...
CVE-2015-9282
The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard, this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard...
CVE-2015-9282
The CVE-2015-9282 entry concerns the Grafana Pie Chart Panel plugin (up to 2019-01-02). The vulnerability is an XSS flaw in legend or tooltip data, enabling an attacker to influence a Grafana dashboard when the chart is embedded. The underlying cause is untrusted data being rendered in chart UI c...