PT-2022-25345 · Openkm · Openkm

Name of the Vulnerable Software and Affected Versions: OpenKM version 6.3.11 Description: The issue allows stored XSS related to the javascript: substring in an A element. This could potentially lead to malicious script execution when a user interacts with the affected element. Recommendations: F...

MAL-2022-993 Malicious code in anchor-website-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 310732123214607507c810eb1c7f5e41532ef6717624fc015030b352daf9275f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in anchor-website-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 310732123214607507c810eb1c7f5e41532ef6717624fc015030b352daf9275f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview jet-anchor-test is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious code in jet-anchor-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6cc3c062f5b8483a9c54231b0e57bff853098b38381439e1041b240085a4767 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Anchor 安全漏洞

Anchor is an open source lightweight blogging system. A security vulnerability exists in Anchore Enterprise anchorectl version 0.1.4, which stems from incorrectly stored credentials when generating the software bill of materials. anchorectl will add credentials used to access the Anchore Enterpri...

Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java OpenSAML-J before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a...

GHSA-737W-MH58-CXJP Arbitrary code execution in Apache Struts

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the 1 URL or 2 A tag...

GHSA-HXCW-PQQC-RV85 Anchor CMS Logs Credentials

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

Anchor CMS Logs Credentials

An issue was discovered in config/error.php in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred...

GHSA-7GHM-RPC7-P7G5 Code injection in Apache Struts

A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks. both the s:url and s:a tag provide an includeParams attribute. The main scope of that attribute is to understand whether includes...

Cross-site Scripting (XSS)

fullpage.js is vulnerable to cross-site scripting. Lack of sanitization of anchor URL before putting it in anchor href in alvarotrigo/fullpage.js allows an attacker to inject malicious javascript...

GHSA-H3CQ-J957-VHXG Cross-site Scripting in fullpage.js

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element...

Cross-site Scripting in fullpage.js

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element...

CVE-2022-1330

stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss...

stored xss due to unsantized anchor url

BUG ====== stored xss due to unsantized anchor url SUMMURY ========= using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow to break context of anchor element and can add our new element . I see main javascript or other javascript...

GHSA-322V-P3JC-7HRG Cross-Site Request Forgery in Anchor CMS

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery CSRF via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts...

Cross-Site Request Forgery in Anchor CMS

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery CSRF via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts...

Cross-Site Request Forgery (CSRF)

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery CSRF via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts...

Cross-Site Request Forgery (CSRF)

anchorcms/anchor-cms is vulnerable to cross-site request forgery. The vulnerability exists because the token is not checked when deleting the posts in posts.php which allows an attacker to arbitrarily delete the posts...