PT-2024-4928

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability. This could allow an attacker to execute arbitrary JavaScript code in the context of the victim's...

PT-2024-4488

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.20 and earlier Description The issue is a DOM-based Cross-Site Scripting XSS vulnerability that could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session...

PT-2024-4464

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.20 and earlier Description The issue is a DOM-based Cross-Site Scripting XSS vulnerability that could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session...

PT-2024-4493

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.20 and earlier Description The issue exists due to inadequate protection of the web page structure in Adobe Experience Manager. This could allow a remote attacker to execute arbitrary code. The vulnerabili...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...

Mozilla: Arbitrary JavaScript execution in PDF.js

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context...

CVE-2024-3402 Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt

A stored Cross-Site Scripting XSS vulnerability existed in version 20240121 of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model,...

CVE-2024-3166 Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm

A Cross-Site Scripting XSS vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, whic...

CVE-2024-3166

Summary: CVE-2024-3166 affects mintplex-labs/anything-llm, including desktop v1.2.0 to v1.4.1 and the web app. The vulnerability is an XSS in the feature that fetches and embeds external website content into workspaces, with a route to Remote Code Execution in the desktop app due to Electron sett...

AnythingLLM Cross-Site Scripting Vulnerability

AnythingLLM is a business-compliant document chatbot. A cross-site scripting vulnerability exists in AnythingLLM that stems from the application's ability to fetch content from a website and embed it in the workspace, which can be exploited to execute arbitrary JavaScript code...

GHSA-4M3G-6R7G-JV4F Arbitrary JavaScript execution due to using outdated libraries

Summary gradio-pdf projects with dependencies on the pdf.js library are vulnerable to CVE-2024-4367, which allows arbitrary JavaScript execution. PoC 1. Generate a pdf file with a malicious script in the fontmatrix. This will run alert‘XSS’. poc.pdf 2. Run the app. In this PoC, I've used the demo...

Cross-Site Scripting (XSS)

typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper user input encoding of notifications shown in modal windows within the TYPO3 backend, which allows an attacker with a valid backend user account to execute arbitrary JavaScript in a users browser...

PDF.js < 4.2.67 - Arbitrary JavaScript Execution

Description PDF.js is vulnerable to Arbitrary JavaScript Execution in versions prior to 4.2.67. This is due to a missing type check when handling fonts. This makes it possible for authenticated attackers, with contributor-level or above permissions, to execute arbitrary JavaScript if they can...

CVE-2024-31907

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 289889...

CVE-2024-25976

When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the...

CVE-2024-25976

When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the...

CVE-2024-25976

The HAWKI university teaching interface, developed by the HAWK Digital Environments team, is vulnerable to reflected Cross-Site Scripting (XSS) when LDAP authentication is enabled. The root cause is a flaw in the login.php file, where the content of **age$ extunderscoreSERVER['PHP_SELF']** is ref...

CVE-2024-25976 Reflected Cross-Site-Scripting (XSS)

When LDAP authentication is activated in the configuration it is possible to obtain reflected XSS execution by creating a custom URL that the victim only needs to open in order to execute arbitrary JavaScript code in the victim's browser. This is due to a fault in the file login.php where the...

PT-2024-21250

Name of the Vulnerable Software and Affected Versions Software affected versions not specified Description The issue allows for reflected XSS execution when LDAP authentication is activated in the configuration. This can be achieved by creating a custom URL that, when opened by the victim, execut...

Code Injection

pug is vulnerable to Code execution. The vulnerability is due to the lack of proper input validation for the name option in the compileClient, compileFileClient, or compileClientWithDependenciesTracked functions, which allows attackers to execute arbitrary JavaScript code in the context of the...