10799 matches found
GHSA-GVXV-P9RV-GMCG brotkrueml/typo3-matomo-integration vulnerable to Cross-Site Scripting
The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...
brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS
The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...
Cross-Site Scripting in TYPO3's Form Framework
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 4.9 Problem It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this...
GHSA-3R95-23JP-MHVG Cross-Site Scripting in TYPO3's Form Framework
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 4.9 Problem It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this...
Authentication flaw
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 4.10.11 and 5.2.2, the certificate in the Parse Server Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake...
Path traversal for local publishers in TechDocs backend
Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local. This vulnerability is mitigated by the fact that the Software Catalog must be...
@backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=0.14.1), @backstage/techdocs-common (>=0.11.13, <=0.11.15) +1 more potentially affected by unknown CVE via @backstage/plugin-techdocs-node (>=1.0.0, <=1.1.1-next.1)
@backstage/plugin-techdocs-node NPM version =1.0.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =0.8.16 Source cves: unknown CVE Source advisory: OSV:GHSA-4JQC-JVH2-PXG9...
GHSA-4JQC-JVH2-PXG9 Path traversal for local publishers in TechDocs backend
Impact A malicious actor with the ability to register entities in the Software Catalog is able to write files to arbitrary paths on the techdocs backend host instance when techdocs.publisher.type is set to local. This vulnerability is mitigated by the fact that the Software Catalog must be...
Miscomputed sha2 results when using AVX2 backend
The v0.9.7 release of the sha2 crate introduced a new AVX2-accelerated backend which was automatically enabled for all x86/x8664 CPUs where AVX2 support was autodetected at runtime. This backend was buggy and would miscompute results for long messages i.e. messages spanning multiple SHA blocks. T...
PT-2022-21716 · Typo3 · Wp-Matomo Integration
Name of the Vulnerable Software and Affected Versions: matomo integration extension versions prior to 1.3.2 Description: The issue allows for XSS due to the extension's failure to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit this issue...
ZZCMS SQL注入漏洞
zzcms Webmaster Merchants Content Management System, developed by the zzcms team, incorporates database optimization, content caching, AJAX and other technologies to make the site's security, stability, and load capacity is reliably guaranteed. The source code is open and the functional modules a...
CVE-2022-31044 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created...
NestJS Proxy 信息泄露漏洞
NestJS Proxy is a Finastra open source NestJS module for decorating and proxying calls. An information disclosure vulnerability exists in NestJS Proxy versions prior to 0.7.0 that stems from the nestjs-proxy library's inability to prevent the forwarding of sensitive cookies e.g., session cookies ...
TYPO3 XSS Vulnerability (TYPO3-CORE-SA-2022-003)
TYPO3 is prone to a cross-site scripting XSS vulnerability in the form framework. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2022-31048 Cross-Site Scripting in Form Framework
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit...
CVE-2022-31048
TYPO3’s Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user with access to the Form module can exploit it. Affected TYPO3 versions prior to the fixes are 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11. The problem is fixed in those releas...
CVE-2022-31048 Cross-Site Scripting in Form Framework
TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit...
CVE-2021-35114
Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto...