PT-2021-12155

Name of the Vulnerable Software and Affected Versions IBM Workload Automation version 9.5 Description The issue allows sensitive information to be stored in HTML comments, which could aid in further attacks against the system. Recommendations For IBM Workload Automation version 9.5, consider...

CVE-2020-23960

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Admin Console in Fork before 5.8.3 allows remote attackers to perform unauthorized actions as administrator to 1 approve the mass of the user's comments, 2 restoring a deleted user, 3 installing or running modules, 4 resetting the...

Security Bulletin: HTML comments with sensitive information could be present in IBM Workload Scheduler

Summary HTML comments with sensitive information, as file locations, machine or user names, could be present in IBM Dynamic Workload Console 9.5 Vulnerability Details CVEID: CVE-2020-4673 DESCRIPTION: IBM Workload Automation stores sensitive information in HTML comments that could aid in further...

CVE-2020-4673

IBM Workload Automation 9.5 stores sensitive information in HTML comments that could aid in further attacks against the system. IBM X-Force ID: 186286...

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized...

Code injection

A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...

IPS Community Suite Cross-Site Scripting Vulnerability

IPS Community Suite is an Internet community software produced mainly by Invision Power Services, which is written in PHP and uses MySQL as a database management system. Versions of IPS Community Suite prior to 4.5.4.2 are vulnerable to a cross-site scripting vulnerability during a quoted post or...

Invision Community 跨站脚本漏洞

IPS Community Suite is an Internet community software produced mainly by Invision Power Services, which is written in PHP and uses MySQL as a database management system. Versions of IPS Community Suite prior to 4.5.4.2 are vulnerable to a cross-site scripting vulnerability during a quoted post or...

NetBox Cross-Site Scripting Vulnerability

NetBox is an IP address management IPAM and data center infrastructure management DCIM tool. A cross-site scripting vulnerability exists in NetBox 2.6.2 and earlier versions. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via /dcim/sites/add/comments...

CVE-2019-25011

NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments...

CVE-2019-25011: Improper Neutralization of Input During Web Page Generation

NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field, as demonstrated by /dcim/sites/add/ comments...

Freki - Malware Analysis Platform

Freki is a free and open-source malware analysis platform. Goals 1. Facilitate malware analysis and reverse engineering; 2. Provide an easy-to-use REST API for different projects; 3. Easy deployment via Docker; 4. Allow the addition of new features by the community. Current features Hash...

hibernate-validator: safeHTML validator allows XSS

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...

hibernate-core: SQL injection vulnerability when both hibernate.use_sql_comments and JPQL String literals are used

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized...

CVE-2020-7776

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is...

CVE-2020-7776

CVE-2020-7776 affects phpoffice/phpspreadsheet (0.0.0 and earlier): the HTML writer concatenates user comments into links when exporting to HTML from an Excel file, enabling XSS in HTML output. Root cause: HTML writer handling of cell comments. A fix is available in commit 0ed5b800be2136bcb8fa9c1...

CVE-2020-7776

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is...

PT-2020-19785 · Phpoffice · Phpspreadsheet

Name of the Vulnerable Software and Affected Versions: phpoffice/phpspreadsheet versions 0.0.0 and earlier Description: The library is vulnerable to XSS when creating an HTML output from an Excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where us...

PHPOffice PhpSpreadsheet Cross-Site Scripting Vulnerability

PHPOffice PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. A security vulnerability exists in version 0.0.0 of phpoffice/phpspreadsheet, which originates from the affected package phpoffice phpspreadsheet from 0.0.0. The library is susceptible to XSS attacks when creatin...