Security Bulletin: Client-side HTTP Parameter Pollution in WAS Intelligent Management Admin console

Summary Client-side HTTP Parameter Pollution in WAS Intelligent Management Admin console. TWAS pen testing uncovered an issue with the admin console that allows Client-side HTTP Parameter Pollution. The user must be navigating the affected resources. Client-side HTTP parameter pollution HPP...

Microweber 跨站脚本漏洞

Microweber is a drag-and-drop online store management system from the Microweber community in the United States. The system includes modules for adding products, images, etc. A cross-site scripting vulnerability exists in Microweber, which stems from the program's lack of checksum filtering of...

GalleryCMS Cross-Site Scripting Vulnerability

GalleryCMS is a free image gallery CMS based on the CodeIgniter 2.1 framework from Aaron Benson, a US-based individual developer. GalleryCMS v2.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation in the albumname parameter in /index.php/album/add for...

WordPress Plugin Easy Google Maps Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the version of WordPress plugin Easy Google Maps before 1.9.32, which can be exploited by attackers...

WordPress plugin Tripetto 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Tripetto plugin 5.1.4 and previous versions contain a cross-site scripting vulnerability th...

nopCommerce 跨站脚本漏洞

nopCommerce is an open source general-purpose e-commerce platform. nopCommerce version 4.50.1 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied and output data in the "Text" parameter when creating a new post. An attacker...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2022-46307)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution enables the management of all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for those assets.IBM Maximo...

chatwoot cross-site scripting vulnerability

chatwoot is an application. Customer engagement suite, an open source alternative to intercom, Zendesk, Salesforce Service Cloud, etc. chatwoot suffers from a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An...

Code injection

An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker...

Wire cross-site scripting vulnerability (CNVD-2022-31755)

Wire is a chat program from the German company Wire. The program supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original way of saying hello, PING. A cross-site scripting vulnerability exists in the Wire webapp, which stems fr...

MISP Cross-Site Scripting Vulnerability (CNVD-2022-64093)

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerability exists in versions prior to MISP 2.4.158, which...

CVE-2021-32927: Improper Neutralization of Input During Web Page Generation

An attacker may be able to inject client-side JavaScript code on multiple instances within all versions of Uffizio GPS Tracker...

PT-2022-10152

Name of the Vulnerable Software and Affected Versions Uffizio GPS Tracker versions all Description An attacker may be able to inject client-side JavaScript code on multiple instances within the Uffizio GPS Tracker. Recommendations At the moment, there is no information about a newer version that...

MISP Cross-Site Scripting Vulnerability (CNVD-2022-64092)

MISP is an open source software solution. The product is used to collect, store, distribute, and share network security metrics and has features such as threat network security event analysis and malware analysis. cross-site scripting vulnerability exists in versions prior to MISP 2.4.158, which...

Zimbra Cross-Site Scripting Vulnerability

Zimbra Collaboration aka ZCS version 9.0 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An attacker could exploit the vulnerability to execute JavaScript code on the client side...

10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +2678 more potentially affected by CVE-2022-25844 via angular (>=1.7.0, <=1.8.3)

angular NPM version =1.7.0, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2022-25844 Source advisory: SNYK:JS-ANGULAR-2772735...

OpenAPI Missing MIME Types

OpenAPI specification is an API description format for REST APIs. An OpenAPI file is written in YAML or JSON and describes all the API properties like the available endpoints with the related operations or the authentication methods. The consumes field defines the expected data types for POST, PU...

WordPress Text Hover plugin cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Text Hover plugin, which stems from the fact that the plugin does not clean up and...

WordPress Easy Digital Downloads plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy Digital Downloads plugin is vulnerable to a cross-site scripting vulnerability that stems from...

WordPress SearchIQ plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress plugin is an application plugin. WordPress SearchIQ plugin has...