Cisco Webex Video Mesh Cross-Site Scripting Vulnerability

Cisco Webex Video Mesh is a software from Cisco, U.S.A. Cisco Webex Video Mesh dynamically finds the best combination of local and cloud conferencing resources. When local resources are sufficient, local meetings stay local. When local resources are exhausted, the conference is expanded to the...

Payment Terminal 2.x / 3.x Cross Site Scripting

Document Title: =============== Payment Terminal 2.x & v3.x - Multiple XSS Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2280 Release Date: ============= 2021-11-05 Vulnerability Laboratory ID VL-ID:...

GitLab 跨站脚本漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. GitLab suffers from a cross-site scripting vulnerability that stems from the la...

Fortinet FortiAnalyzer Cross-Site Scripting Vulnerability (CNVD-2021-84244)

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

CVE-2021-43032

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side...

Holiday Shopping Season is Upon Us: The State of Security Within eCommerce in 2021

The eCommerce industry has gone through years worth of changes in a matter of just a mere couple of months as the global pandemic emerged back in March of 2020. These changes have led to skyrocketing growth for the industry, with sales predicted to hit $4.921 trillion by the end of this year. And...

Sonicwall SonicOS 6.5.4 - (Common Name) Cross-Site Scripting Vulnerability

Exploit Title: Sonicwall SonicOS 6.5.4 - 'Common Name' Cross-Site Scripting XSS Vendor Homepage: https://www.sonicguard.com/NSV-800.asp Product & Service Introduction: =============================== The design, implementation and deployment of modern network architectures, such as virtualization...

ElkarBackup 跨站脚本漏洞

ElkarBackup is an open source backup product based on RSync/RSnapshot technology to backup data on windows/linux platforms. ElkarBackup cross-site scripting vulnerability , the vulnerability stems from the lack of WEB applications on the client data correctly validated . An attacker can exploit...

DynPG 跨站脚本漏洞

Dynpg Organization Dynpg is Dynpg Organization an open source application. It is used to create web sites. A security vulnerability exists in DynPG, which stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit the vulnerability to execute client-si...

Fortinet FortiAnalyzer 跨站脚本漏洞

Fortinet FortiAnalyzer is a set of centralized network security reporting solutions from the U.S. company Fiat Fortinet. The product is mainly used to collect network log data, and through the reporting suite of security events in the log, network traffic, Web content, etc. to analyze, report,...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Wordpress plugin Content text slider, which stems...

Exploit for Cross-site Scripting in Xenforo

CVE-2021-43032 In XenForo ≤ 2.2.7, a threat actor with access...

Recent NPM package hack is an alarming reminder of the risks of website supply-chain fraud

There are over 1.8 billion websites online today. Almost 98% of them are powered by JavaScript, and for a good reason: JavaScript’s flexibility and portability enable the rich online functionality we’ve all come to know and love. But when that same functionality becomes a significant vector for...

MyBB Cross-Site Scripting Vulnerability (CNVD-2021-103573)

MyBB is a free and web-based forum software developed by MyBB team using PHP and MySQL. MyBB has a cross-site scripting vulnerability in versions prior to 1.8.28, which stems from the lack of proper validation of client-side data in the template name displayed in the theme management of the WEB...

Akaunting Cross-Site Scripting Vulnerability (CNVD-2021-103569)

Akaunting, an application from Akaunting, Inc. provides all the tools needed to manage funds online.Akaunting version 1.3.17 contains a cross-site scripting vulnerability that stems from a lack of checksum filtering of user-supplied and output data in the company name input field. An attacker cou...

WordPress Special Text Boxes plugin cross-site scripting vulnerability

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Special Text Boxes plugin in versions prior to 5.9.109 suffers from a cross-site scripting vulnerabili...

Shopware Cross-Site Scripting Vulnerability (CNVD-2021-103572)

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware in versions prior to 5.7.6 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

Folder Lock Cross-Site Scripting Vulnerability

Folder Lock is a perfect data security application from NewSoftwares, Inc. Folder Lock is vulnerable to a cross-site scripting vulnerability in v3.4.5, which stems from the " Create Folder" function under the "Create" module lacks a data validation filter for user-supplied data and output. An...

@atlassian/aui (>=8.2.4, <=9.4.1), @chinchilla-software/ng-date-time-picker (>=1.0.0, <=1.0.1) +129 more potentially affected by CVE-2021-41184 via jquery-ui (>=1.10.4, <=1.12.1)

jquery-ui NPM version =1.10.4, =8.2.4, =1.0.0, =1.0.0, =0.1.0, =2.3.2, =6.4.0, =1.1.42, =5.0.0-110, =0.0.0, =2.1.1, =4.0.0, =1.0.0-alpha.0, =11.0.0, =17.0.0-dev.3 and more Source cves: CVE-2021-41184 Source advisory: OSV:GHSA-GPQQ-952Q-5327...

Tibco Software TIBCO Nimbus 跨站脚本漏洞

Tibco Software TIBCO Nimbus is a business application for process documentation from Tibco Software, USA. A cross-site scripting vulnerability exists in TIBCO Nimbus, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerabilit...