HCL Technologies Traveler Companion Cross-Site Scripting Vulnerability

HCL Technologies Traveler Companion is an ios Iphone and Ipad application from HCL Technologies, India. It is used to read encrypted Hcl Notes emails on Apple devices.A cross-site scripting vulnerability exists in HCL Technologies Traveler Companion version 12.0.1.0 and earlier, which stems from...

mxGraph vulnerable to cross-site scripting in color field

mxGraph through 4.0.0, related to the draw.io Diagrams plugin before 8.3.14 for Confluence and other products, is vulnerable to cross-site scripting. draw.io Diagrams allows the creation and editing of draw.io-based diagrams in Confluence. Among other things, it allows to set the background color...

MGASA-2022-0188 Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to the 101.0.4951.64 version, fixing many bugs and 13 CVE. Some of them are listed below: 1316990 High CVE-2022-1633: Use after free in Sharesheet. Reported by Khalil Zhani on 2022-04-18 1314908 High CVE-2022-1634: Use after free in Browser UI...

GHSA-28PV-2J2H-FMHC TeamPass Cross-Site Scripting (XSS)

Cross-Site Scripting XSS was discovered in TeamPass before 2.1.27.9. The vulnerability exists due to insufficient filtration of data in /sources/folders.queries.php. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...

Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness

Dojo Dojo Objective Harness DOH version prior to version 1.14 contains a Cross Site Scripting XSS vulnerability in unit.html and testsDOH/base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliv...

Jenkins Build-Publisher plugin has Insufficiently Protected Credentials

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.buildpublisher.BuildPublisher.xml in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to acce...

XSS in JSON: Old-School Attacks for Modern Applications

I recently wrote a blog post on injection-type vulnerabilities and how they were knocked down a few spots from 1 to 3 on the new OWASP Top 10 for 2022. The main focus of that article was to demonstrate how stack traces could be — and still are — used via injection attacks to gather information...

USN-5394-1: WebKitGTK vulnerabilities

A large number of security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service...

Minor update (6) for Vivaldi Desktop Browser 5.2

Download Vivaldi The following improvements were made since the fifth 5.2 stable, minor update: Chromium Upgraded to 100.0.4896.133 includes fix for CVE-2022-1364 Main photo byVidar Nordli-Mathisen...

Organizr file upload vulnerability

Organizr is a tab management system. Designed to be a one-stop store for server front ends, Organizr versions prior to 2.1.1810 have a file upload vulnerability that stems from the lack of valid validation of uploaded files by the application, which can be exploited by attackers to upload .svg...

Persistent Cross-site Scripting vulnerability in PrivateBin

In PrivateBin polygon id="triangle" points="0,0 0,50 50,0" fill="00990...

CVE-2022-24074

CVE-2022-24074 affects Whale Browser prior to 3.12.129.18, where the default extension Whale Bridge could receive any SendMessage request from the content script itself. This could allow an attacker to control Whale Bridge if the rendering process is compromised. The reported remediation is to up...

Safari < 15.4 Multiple Vulnerabilities

Binary data 701395.pasl...

Automatic Question Paper Generator System 1.0 Cross Site Scripting Vulnerability

Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html Version: 1.0 Tested on: Linux Title: ================...

CVE-2022-24762

CVE-2022-24762 affects sysend.js, a library for inter-page messaging in the same browser. The vulnerability arises from cross-origin communication where messages may be intercepted, leaking information. The impact focuses on confidentiality (high severity per CVSS 3.1/3.1 metrics) and is constrai...

GHSA-7563-75J9-6H5P Sensitive Information Exposure in Sylius

Impact Any other user can view the data if the browser tab remains open after logging out. Once someone logs out and leaves the browser open, the potential attacker may use the back button to see the content exposed on given screens. No action may be performed though, and any website refresh will...

MGASA-2022-0099 Updated chromium-browser-stable packages fix security vulnerability

The chromium-browser-stable package has been updated to the 99.0.4844.51 version that fixes multiples security vulnerabilities...

Automatic Question Paper Generator System 1.0 Cross Site Scripting

Exploit Title: Automatic Question Paper Generator System 1.0 - Cross-site scripting stored Date: 2022-11-03 Exploit Author: Mr Empy Software Link: https://www.sourcecodester.com/php/15190/automatic-question-paper-generator-system-phpoop-free-source-code.html Version: 1.0 Tested on: Linux Title:...

CVE-2022-24917

An authenticated user can create a link with reflected Javascript code inside it for services’ page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict. Malicious code has access to all...

SUSE-SU-2022:0676-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 bsc1195682 - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during upda...