Carrier LenelS2 HID Mercury access panels 安全漏洞

Carrier LenelS2 HID Mercury access panels is a controller panel from Carrier, Inc. A security vulnerability exists in Carrier LenelS2 HID Mercury access panels, which could be exploited to send a specially crafted packet to update the web interface The "Comments" section of the homepage...

UBUNTU-CVE-2022-31743

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox 101...

Mozilla Firefox < 101.0

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 101.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-20 advisory. - Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Tea...

Angular 跨站脚本漏洞

Angular is a development platform. It is used to build mobile and desktop web applications using Typescript / JavaScript and other languages. A security vulnerability exists in Angular version 11.0.4, 11.1.0-next.2, which stems from the fact that HTML does not specify any method to escape text in...

GHSA-X78V-4FVJ-RG9J Camaleon CMS Stored Cross-site Scripting vulnerability

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious...

Camaleon CMS Stored Cross-site Scripting vulnerability

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the comliferaysitemysiteswebportletMySitesPortletcomments parameter in membership request administration pages. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...

GHSA-69WW-WV3J-MHG4 Comments plugin stored Cross-site Scripting (XSS) via an asset volume name

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...

GHSA-4R8C-PJ7X-M5JX Comments plugin Cross-Site Request Forgery (CSRF)

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...

Comments plugin Cross-Site Request Forgery (CSRF)

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...

GHSA-JHHF-C849-3RH2 Comments plugin stored Cross-site Scripting via a guest name

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name...

Comments plugin stored Cross-site Scripting via a guest name

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name...

Comments plugin stored Cross-site Scripting (XSS) via an asset volume name

An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...

Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Retur...

GHSA-3MXQ-V9RW-M6X9 Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Retur...

Cross-site Scripting (XSS)

Overview fatfreecrm is a customer relationship management platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via an authenticated request to the /comments URI. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...

Camaleon CMS Stored Cross-site Scripting vulnerability

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious...

CVE-2022-1192

The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-1192

The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

WordPress plugin Turn off all comments 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed using the PHP language. A cross-site scripting vulnerability exists in the WordPress Turn off all comments plugin, which stems from a failure to clean and escape rows parameters before...