8447 matches found
CVE-2024-37174
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application...
CVE-2024-37174 [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application...
CVE-2024-37174
The CVE-2024-37174 entry concerns SAP CRM WebClient UI, where a Cross-Site Scripting vulnerability arises from insufficient encoding of user-controlled input in the Custom CSS support option. The issue affects the WebClient UI and can impact confidentiality and integrity to a limited degree, with...
CVE-2024-37174 [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application...
CVE-2024-37174: Improper Neutralization of Input During Web Page Generation
Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs resulting in Cross-Site Scripting vulnerability. On successful exploitation an attacker can cause limited impact on confidentiality and integrity of the application...
CVE-2024-5810: Use of Hard-coded Credentials
The WP2Speed Faster – Optimize PageSpeed Insights Score 90-100 plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.1. This is due to the use of hardcoded credentials to authenticate all the incoming API requests. This makes it possible for...
SAP CRM cross-site scripting vulnerability
SAP CRM is a customer relationship management system from SAP, Germany. SAP CRM suffers from a cross-site scripting vulnerability that stems from custom CSS support options that do not adequately encode user-controlled input, which can be exploited by an attacker to execute arbitrary web script o...
MAL-2024-7429 Malicious code in css-rule-extractor (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e9ced95ce8313baa1160e05f65af9e6247750f6dbd09fcaf40d1ded1874a86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in css-rule-extractor
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in css-rule-extractor (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e9ced95ce8313baa1160e05f65af9e6247750f6dbd09fcaf40d1ded1874a86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2024-27356
Name of the Vulnerable Software and Affected Versions SAP CRM WebClient UI affected versions not specified Description The Custom CSS support option in SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting issue. On successful exploitation, ...
@aofl/cli (>=4.0.0-alpha.0, <=4.0.0-alpha.45), @aofl/html-webpack-purify-internal-css-plugin (>=4.0.0-alpha.22, <=4.0.0-alpha.45) +4 more potentially affected by CVE-2024-38987 via @aofl/cli-lib (4.0.0-alpha.45)
@aofl/cli-lib NPM version 4.0.0-alpha.45 is affected by a known vulnerability. The following packages have a transitive dependency on @aofl/cli-lib and may be impacted: - @aofl/cli =4.0.0-alpha.0, =4.0.0-alpha.22, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.45...
CVE-2024-5019
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Arbitrary File Read issue exists in Wug.UI.Areas.Wug.Controllers.SessionController.CachedCSS. This vulnerability allows reading of any file with iisapppool\NmConsole privileges...
MAL-2024-6651 Malicious code in applied-css (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in applied-css (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in actionmailer-inline_css (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2508 Malicious code in incom-css (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in incom-css (npm)
--- -= Per source details. Do not edit below this line.=-...
CVE-2024-3249
CVE-2024-3249: The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized data modification due to missing capability checks on import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings in all versions up to 1.6.2. Authenticated a...
SUSE CVE-2024-38547
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: sshcss: Fix a null-pointer dereference in loadvideobinaries The allocation failure of mycs-yuvscalerbinary in loadvideobinaries is followed with a dereference of mycs-yuvscalerbinary after the following call chain...