yyanchordrillingrig.com Cross Site Scripting vulnerability OBB-3029778

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in anchor-lang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ead75f6f1a06885c859de3db6135c335ed8dfe9a9f6b95aa938723e6cf38c80a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-992 Malicious code in anchor-lang (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ead75f6f1a06885c859de3db6135c335ed8dfe9a9f6b95aa938723e6cf38c80a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OpenKM 跨站脚本漏洞

OpenKM is a document management system from OpenKM Spain. The system provides features such as version control, document history and file sharing. A security vulnerability exists in OpenKM version 6.3.11, which originates from a stored cross-site script that can be realized by an attacker via a...

PT-2022-25345 · Openkm · Openkm

Name of the Vulnerable Software and Affected Versions: OpenKM version 6.3.11 Description: The issue allows stored XSS related to the javascript: substring in an A element. This could potentially lead to malicious script execution when a user interacts with the affected element. Recommendations: F...

MAL-2022-993 Malicious code in anchor-website-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 310732123214607507c810eb1c7f5e41532ef6717624fc015030b352daf9275f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in anchor-website-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 310732123214607507c810eb1c7f5e41532ef6717624fc015030b352daf9275f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview jet-anchor-test is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious code in jet-anchor-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6cc3c062f5b8483a9c54231b0e57bff853098b38381439e1041b240085a4767 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Anchor 安全漏洞

Anchor is an open source lightweight blogging system. A security vulnerability exists in Anchore Enterprise anchorectl version 0.1.4, which stems from incorrectly stored credentials when generating the software bill of materials. anchorectl will add credentials used to access the Anchore Enterpri...

Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java OpenSAML-J before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a...

GHSA-737W-MH58-CXJP Arbitrary code execution in Apache Struts

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag...

GHSA-HXCW-PQQC-RV85 Anchor CMS Logs Credentials

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

Anchor CMS Logs Credentials

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

GHSA-7GHM-RPC7-P7G5 Code injection in Apache Struts

A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks. both the s:url and s:a tag provide an includeParams attribute. The main scope of that attribute is to understand whether includes...

Cross-site Scripting (XSS)

fullpage.js is vulnerable to cross-site scripting. Lack of sanitization of anchor URL before putting it in anchor href in alvarotrigo/fullpage.js allows an attacker to inject malicious javascript...

GHSA-H3CQ-J957-VHXG Cross-site Scripting in fullpage.js

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element...

Cross-site Scripting in fullpage.js

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element...

CVE-2022-1330

stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss...

stored xss due to unsantized anchor url

BUG ====== stored xss due to unsantized anchor url SUMMURY ========= using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow to break context of anchor element and can add our new element . I see main javascript or other javascript...