565 matches found
CVE-2021-24745
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in attributes, which could allow user with a role as low as contributor to perform Cross-Site Scripting attacks...
CVE-2021-24745
CVE-2021-24745 affects the WordPress plugin About Author Box (versions before 1.0.2). The root cause is failure to sanitize and escape values in the Social Profiles field before rendering in attributes, enabling a stored cross-site scripting (XSS) flaw. The issue permits a user with a low-privile...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in versions of Th...
secure.action.news Cross Site Scripting vulnerability OBB-2282566
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress About Author Box plugin <= 1.0.1 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Francesco Carlucci in WordPress About Author Box plugin versions = 1.0.1. Solution Update the WordPress About Author Box plugin to the latest available version at least 1.0.2...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Membership & Learning Management System...
CVE-2021-31794
Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header...
Directum 跨站脚本漏洞
Directum is an application system of the Russian company Directum. An intelligent digital process and documentation system. A cross-site scripting vulnerability exists in Settings.aspx?view=About in Directum version 5.8.2. An attacker can exploit this vulnerability via the HTTP User-Agent header ...
CVE-2021-23985
If an attacker is able to alter specific about:config values for example malware running on the user's computer, the Devtools remote debugging feature could have been enabled in a way that was unnoticable to the user. This would have allowed a remote attacker able to make a direct network...
UBUNTU-CVE-2021-23975
The developer page about:memory has a Measure function for exploring what object types the browser has allocated and their sizes. When this function was invoked we incorrectly called the sizeof function, instead of using the API method that checks for invalid pointers. This vulnerability affects...
PT-2021-14664 · Jenkins · Jenkins Support Core Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Support Core Plugin versions 2.72 and earlier Description: The issue concerns the provision of serialized user authentication as part of the "About user basic authentication details only" information, which can include the session ID ...
Hitachi Vantara Pentaho 跨站脚本漏洞
Pentaho is a Business Intelligence BI software that provides data integration, OLAP services, reporting, information dashboards, data mining, and Extract, Transform, Load ETL capabilities. A DOM-type cross-site scripting vulnerability exists in Hitachi Vantara Pentaho in the Analysis Report...
The vulnerability in the WebExtensions extension of the Mozilla Firefox browser allows a hacker to gain unauthorized access to protected information.
The vulnerability of the WebExtensions extension in the Mozilla Firefox browser is related to deficiencies in restrictions when using the URL “view-source:” for viewing the local URL “file:”, as well as content stored in “about:cache”. Exploiting this vulnerability can allow an attacker to gain...
BELL-CVE-2020-16119 CVE-2020-16119 does not affect BellSoft software
Bulletin has no description...
November 19, 2020—KB4586839 (OS Build 17763.1613) Preview
None None...
lookn4u.com Cross Site Scripting vulnerability OBB-1428481
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Google Responds to Warrants for “About” Searches
One of the things we learned from the Snowden documents is that the NSA conducts "about" searches. That is, searches based on activities and not identifiers. A normal search would be on a name, or IP address, or phone number. An about search would something like "show me anyone that has used this...
DEBIAN-CVE-2020-15664
By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious...
Mozilla: Attacker-induced prompt for extension installation
By holding a reference to the eval function from an about:blank window, a malicious webpage could have gained access to the InstallTrigger object which would allow them to prompt the user to install an extension. Combined with user confusion, this could result in an unintended or malicious...