ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.26) +62 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=7.0.8, <=7.0.69)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =7.0.8, =0.0.1, =1.0, =1.0, =1.2.1.aghost-fix.20201109, =1.0-release, =1.0-release, =7.0.22, =0.1.0, =1.0, =1.0.b1, =1.0.b11 and more Source cves: CVE-2016-5018 Source advisory: GHSA-4V3G-G84W-HV7R...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.26) +62 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=7.0.8, <=7.0.69)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =7.0.8, =0.0.1, =1.0, =1.0, =1.2.1.aghost-fix.20201109, =1.0-release, =1.0-release, =7.0.22, =0.1.0, =1.0, =1.0.b1, =1.0.b11 and more Source cves: CVE-2016-5018 Source advisory: OSV:GHSA-4V3G-G84W-HV7R...

ch.rasc:embeddedtc (>=2.0, <=2.14), ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6) +100 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.0.1, <=8.0.36)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.0.1, =2.0, =0.0.25, =0.0.4, =1.0.0, =1.0.5, =1.0.5, =0.9.1-beta4, =8.0.18.0-m1, =0.3.0, =0.4.2 and more Source cves: CVE-2016-5018 Source advisory: GHSA-4V3G-G84W-HV7R...

ch.rasc:embeddedtc (>=2.0, <=2.14), ch.sbb.releasetrain:jsfbootadapter (>=0.0.25, <=0.9.6) +100 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.0.1, <=8.0.36)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.0.1, =2.0, =0.0.25, =0.0.4, =1.0.0, =1.0.5, =1.0.5, =0.9.1-beta4, =8.0.18.0-m1, =0.3.0, =0.4.2 and more Source cves: CVE-2016-5018 Source advisory: OSV:GHSA-4V3G-G84W-HV7R...

ch.sbb.releasetrain:webui (>=0.0.26, <=0.9.5), com.sdl.dxa.modules:dxa-module-audience-manager-web8 (1.6.0) +26 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.5.0, <=8.5.4)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.5.0, =0.0.26, =0.0.2, =0.0.1, =0.0.2, =0.0.0, =0.0.0, =0.0.0, =2.1.0, =2.1.0, =2.2.4 and more Source cves: CVE-2016-5018 Source advisory: GHSA-4V3G-G84W-HV7R...

ch.sbb.releasetrain:webui (>=0.0.26, <=0.9.5), com.sdl.dxa.modules:dxa-module-audience-manager-web8 (1.6.0) +26 more potentially affected by CVE-2016-5018 via org.apache.tomcat.embed:tomcat-embed-jasper (>=8.5.0, <=8.5.4)

org.apache.tomcat.embed:tomcat-embed-jasper MAVEN version =8.5.0, =0.0.26, =0.0.2, =0.0.1, =0.0.2, =0.0.0, =0.0.0, =0.0.0, =2.1.0, =2.1.0, =2.2.4 and more Source cves: CVE-2016-5018 Source advisory: OSV:GHSA-4V3G-G84W-HV7R...

Tabs Responsive < 2.2.8 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Create/edit a Tab via the plugin, and put the following payload in a Tab...

Delta Industrial Automation DMARS Project File Parsing XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta Industrial Automation DMARS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

Gmedia Photo Gallery < 1.20.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed PoC https://youtu.be/kTMg65teTvU...

Slide Anything < 2.3.44 - Editor+ Stored Cross-Site Scripting

The plugin does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed Create/edit a Slider with the plugin and put the following payload in a Slide Descriptio...

WordPress Video Embed & Thumbnail Generator plugin < 4.7.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Video Embed & Thumbnail Generator plugin versions 4.7.4. Solution Update the WordPress Video Embed & Thumbnail Generator plugin to the latest available version at least 4.7.4...

WordPress Video Embed & Thumbnail Generator plugin < 4.7.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Video Embed & Thumbnail Generator plugin versions 4.7.4. Solution Update the WordPress Video Embed & Thumbnail Generator plugin to the latest available version at least 4.7.4...

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

CVE-2020-13673

CVE-2020-13673 affects the Drupal core Media module, where a filter for embedding media in content fields can let an unprivileged user inject HTML when viewed by a privileged user, enabling cross-site scripting. The issue is documented by NVD as a XSS risk via the media embedding filter. Remediat...

CVE-2020-13673: Cross-Site Request Forgery (CSRF)

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...

nz.net.osnz.composite:composite-spring-boot-tomcat (5.22), org.apache.tomcat.embed:tomcat-embed-jasper (>=10.0.0-m1, <=10.0.0-m4) +1 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m4)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =10.0.0-m1, =10.0.0-m1, =10.0.0-m4 Source cves: CVE-2020-11996 Source advisory: OSV:GHSA-53HP-JPWQ-2JGQ...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +4087 more potentially affected by CVE-2020-11996 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.34)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2020-11996 Source...