jQuery MiniColors 跨站脚本漏洞

jQuery MiniColors is a small jQuery-based color picker from the individual developer Cory LaViska. A security vulnerability exists in jQuery MiniColors versions prior to 2.3.6, which stems from a cross-site scripting vulnerability that is prone to occur when handling untrusted color names...

PT-2023-12182 · Unknown +1 · Jquery Minicolors +1

Name of the Vulnerable Software and Affected Versions: jQuery MiniColors versions prior to 2.3.6 Description: The issue is related to cross-site scripting when handling untrusted color names. This can be exploited due to the lack of proper input validation in jQuery MiniColors. Recommendations: F...

SUSE CVE-2022-34903

GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints e.g., use of GPGME are met, allows signature forgery via injection into the status line...

CVE-2022-4657 Restaurant Menu < 2.3.6 - Contributor+ Stored XSS via Shortcode

The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress plugin Restaurant Menu 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2022-11595 · Claviska · Jquery Minicolors

Name of the Vulnerable Software and Affected Versions: claviska jquery-minicolors versions up to 2.3.5 Description: A vulnerability was found in the file jquery.minicolors.js, which leads to cross site scripting. The attack may be launched remotely. The manipulation affects some unknown...

Amazon Linux 2022 : gnupg2, gnupg2-minimal, gnupg2-smime (ALAS2022-2022-207)

It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-207 advisory. A vulnerability was found in GnuPG. This issue occurs due to an escape detection loop at the writestatustextandbuffer function in g10/cpr.c. This flaw allows a malicious actor to bypass access control...

CVE-2022-2709

The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Float to Top Button <= 2.3.6 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Put the following payload in the "Text for the button" or "URL ...

CVE-2022-31102

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting XSS bug which could allow an attacker to inject arbitrary JavaScript in the /auth/callback page in a victim's browser. This...

Cross site scripting

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with 2.3.0 and prior to 2.3.6 and 2.4.5 is vulnerable to a cross-site scripting XSS bug which could allow an attacker to inject arbitrary JavaScript in the /auth/callback page in a victim's browser. This...

ArgoCD 跨站脚本漏洞

Argo is an open source container-native workflow engine.ArgoCD is an application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g., configuration in a Git repository,...

Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources...

GHSA-39CH-RG26-GMQ5 Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...

GHSA-6988-G89M-27VF Magento stored cross-site scripting (XSS) in the customer address upload feature

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a stored cross-site scripting XSS in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue...

GHSA-269W-PQC7-68Q9 Magento vulnerable to a file upload restriction bypass

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2022-27043

Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal...

CVE-2022-27043

Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal...

CVE-2022-27043

Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal...

CVE-2022-27043

Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Neptune is vulnerable to Directory Traversal...