62 matches found
CVE-2021-45472
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme among others can be used...
CVE-2021-45474
In MediaWiki through 1.37, the Special:ImportFile URI aka FileImporter allows XSS, as demonstrated by the clientUrl parameter...
MediaWiki 安全漏洞
MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A cross-site scripting vulnerability exists in MediaWiki 1.37 and earlier versions, which can be...
PT-2021-24244 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.37 and earlier Description: The issue allows for XSS to occur in Wikibase due to an external identifier property having a URL format that includes a $1 formatter substitution marker. This can be exploited using the...
PT-2021-24246 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions through 1.37 Description: The issue concerns a problem where the Special:ImportFile URI, also known as FileImporter, in MediaWiki allows for cross-site scripting XSS attacks. This is demonstrated through the clientUrl...
PT-2022-5002 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.35.5 and earlier, 1.36.x before 1.36.3, 1.37.x before 1.37.1 Description: The issue is related to Blind Stored XSS via a URL to the Upload Image feature. This could allow a remote attacker to conduct a cross-site scriptin...
CVE-2020-5669
Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...
Cross site scripting
Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...
CVE-2020-5669
Cross-site scripting vulnerability in Movable Type Movable Type Premium 1.37 and earlier and Movable Type Premium Advanced 1.37 and earlier allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors...
PT-2021-21123 · Mediawiki +1 · Mediawiki +1
Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.37 Description: An issue was discovered in the AbuseFilter extension. If the MediaWiki:Abusefilter-blocker message is invalid within the content language, the filter user falls back to the English version, but th...
CVE-2020-7232
Evoko Home devices 1.31 through 1.37 allow remote attackers to obtain sensitive information such as usernames and password hashes via a WebSocket request, as demonstrated by the sockjs/224/uf1psgff/websocket URI at a wss:// URL...
HPE Integrated Lights-Out 5 Security Restriction Bypass Vulnerability
HPE Integrated Lights-Out 5 iLO 5 is a remote control solution. The solution enables remote monitoring and operation and maintenance of IT assets such as servers. A security restriction bypass vulnerability exists in HPE iLO 5 versions prior to 1.37. An attacker could exploit this vulnerability t...
LiquidVPN For macOS Elevation of Privilege Vulnerability
LiquidVPN For MacOS is a VPN software for anonymous access to the Internet based on the MacOS platform. An elevation of privilege vulnerability exists in the 'openvpncmd' parameter in LiquidVPN For MacOS 1.37 and 1.36 and earlier versions. An attacker can exploit this vulnerability to gain elevat...
LiquidVPN For macOS Operating System Command Injection Vulnerability
LiquidVPN For MacOS is a VPN software for anonymous access to the Internet based on the MacOS platform. An OS command injection vulnerability exists in LiquidVPN For MacOS 1.37 and 1.36 and earlier versions, which stems from the program's failure to filter parameters passed to the 'system'...
LiquidVPN For macOS elevation of privilege vulnerability (CNVD-2018-22843)
LiquidVPN For MacOS is a VPN software for anonymous access to the Internet based on the MacOS platform. An elevation of privilege vulnerability exists in the 'anycmd' parameter in LiquidVPN For MacOS 1.37 and 1.36 and earlier versions. An attacker can exploit this vulnerability to gain elevated...
CloudBees Jenkins EC2 Plugin Arbitrary Command Execution Vulnerability
CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . An...
SAMSUNG NET-i Viewer 1.37 SEH Overwrite
No description provided by source. html object classid='clsid:FA6E2EA9-D816-4F00-940B-609C9E8847A4' id='target' /object script language='vbscript' ' Exploit Title: SAMSUNG NET-i viewer ActiveX SEH Overwrite ' Date: April 30 2012 ' Author: Blake ' Software Link:...
SAMSUNG NET-i Viewer 1.37 - Overwrite (SEH)
' Exploit Title: SAMSUNG NET-i viewer ActiveX SEH Overwrite ' Date: April 30 2012 ' Author: Blake ' Software Link: http://www.samsungsecurity.com/product/productview.asp?idx=5828 ' Version: 1.37 ' Tested on: Windows XP SP3 with IE6 running on Virtualbox ' RequestScreenOptimization in...
Samsung NET-i ware 1.37 - Multiple Vulnerabilities
Samsung NET-i ware 1.37 - Multiple Vulnerabilities Luigi Auriemma Application: Samsung NET-i ware http://www.samsungsecurity.com/product/productview.asp?idx=6447 http://www.samsungsecurity.com/product/productview.asp?idx=5828 Versions: = 1.37 Platforms: Windows Bugs: A Endless loop in remote...