Cross-site Scripting (XSS)

Overview Squidex.ClientLibrary is a ClientLibrary for Squidex Headless CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS due an incomplete blacklist in the SVG inspection process. An attacker can inject malicious JavaScript via the SRC attribute of an IFRAME elemen...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-46857: Improper Neutralization of Input During Web Page Generation

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

Vulnerability fixed in Atlassian Jira

Atlassian has fixed a vulnerability in Jira Assets Discovery. A malicious person with access to the connection between the Assets Discovery Agent and the Assets Discovery application, can exploit the exploit the vulnerability to execute arbitrary code on the system where the Assets Discovery Agen...

CVE-2023-46857

Squidex Headless CMS is affected: versions before 7.9.0 suffer an XSS via an SVG document in the Upload Assets feature due to an incomplete blacklist in the SVG inspection. The attack requires the attacker to have assets.create permission and is possible through the SRC attribute of an IFRAME in ...

CVE-2023-46857

Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. This occurs because there is an incomplete blacklist in the SVG inspection, allowing JavaScript in the SRC attribute of an IFRAME element. An authenticated attack with assets.create permission is required for...

CVE-2023-22523

This vulnerability, if exploited, allows an attacker to perform privileged RCE Remote Code Execution on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application formerly known as Insight Discovery and the Assets Discovery agent...

CVE-2023-22523

This vulnerability, if exploited, allows an attacker to perform privileged RCE Remote Code Execution on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application formerly known as Insight Discovery and the Assets Discovery agent...

CVE-2023-22523

This vulnerability, if exploited, allows an attacker to perform privileged RCE Remote Code Execution on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application formerly known as Insight Discovery and the Assets Discovery agent...

Remote code execution

This vulnerability, if exploited, allows an attacker to perform privileged RCE Remote Code Execution on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application formerly known as Insight Discovery and the Assets Discovery agent...

CVE-2023-22523

This vulnerability, if exploited, allows an attacker to perform privileged RCE Remote Code Execution on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application formerly known as Insight Discovery and the Assets Discovery agent...

CVE-2023-22523

CVE-2023-22523 affects Atlassian’s Jira Service Management Assets Discovery (formerly Insight Discovery) where the vulnerability exists in the communication between the Assets Discovery application and the Assets Discovery agent. The issue enables privileged Remote Code Execution on systems runni...

The vulnerability of the Assets Discovery agent (formerly Insight Discovery), a data processing product of Atlassian Jira Service Management Data Center and Server, as well as Cloud, allows a perpetrator to execute arbitrary code.

The vulnerability of the Assets Discovery agent previously known as Insight Discovery, a data processing tool for Atlassian Jira Service Management Data Center and Server, as well as Cloud, is related to insufficient verification of data authenticity. Exploiting this vulnerability allows an...

Atlassian Assets Discovery Security Vulnerability

Atlassian Assets Discovery is an agentless network scanner from Atlassian Australia. A security vulnerability exists in Atlassian Assets Discovery versions 1.0 through 3.1.11, which stems from a remote code execution vulnerability...

CVE-2023-22523: Undefined Security Weakness

This vulnerability, if exploited, allows an attacker to perform privileged RCE Remote Code Execution on machines with the Assets Discovery agent installed. The vulnerability exists between the Assets Discovery application formerly known as Insight Discovery and the Assets Discovery agent...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to security restrictions bypass due to PostCSS CVE-2023-44270

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to security restrictions bypass due to PostCSS CVE-2023-44270. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2023-44270 DESCRIPTION: PostCSS could allow a remote attacker to bypass security...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service, remote code execution, and cross-site scripting due to multiple vulnerabilities in Go

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to denial of service, remote code execution, and cross-site scripting due to multiple vulnerabilities in Go with details below CVE-2023-39323, CVE-2023-39325, CVE-2023-39319, CVE-2023-39318. The...

CVE-2023-29770

In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering...

Closing the Visibility Gap: How Qualys Cloud Agent Passive Sensor (CAPS) Eliminates Blind Spots Without the Hassle

In modern networks, the most significant risks come from systems that fall through the cracks. Modern networks are full of unknown and unmanaged assets. Some are seemingly benign devices introduced by well-meaning employees or contractors that can turn rogue. While some of these may be genuinely...