CVE-2019-19682

nopCommerce

CVE-2019-19682: Improper Neutralization of Input During Web Page Generation

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/id Admin/Blog/BlogPostEdit/id. NOTE: the...

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting Exploit Title: Stored Cross Site Scripting XSS in Sitecore 9.0 rev 171002 Date: July 11, 2019 Exploit Author: Owais Mehtab Vendor Homepage: http://www.sitecore.net/en Version: 9.0 rev. 171002 Tested on: Sitecore Experience Platform 8.1...

Joomla Content Editor Com_JCE Component Information Disclosure Vulnerability

Joomla is an open source content management system CMS. An information disclosure vulnerability exists in the Joomla Content Editor ComJCE component. An attacker can exploit the vulnerability to obtain database backup information...

Description of the security update for SharePoint Server 2013: July 10, 2018

Description of the security update for SharePoint Server 2013: July 10, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

Description of the security update for SharePoint Foundation 2013: July 10, 2018

Description of the security update for SharePoint Foundation 2013: July 10, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microso...

Cross-site Scripting (XSS) Through SVG Documents

silverstripe/installer and silverstripe/framework are vulnerable to cross-site scripting XSS attacks. These attacks are possible because the Insert Media option within the content editor, and the pathname in admin/assests/add allow attackers to insert SVG documents containing arbitrary javascript...

Code injection

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by 1 the Insert Media option in the content editor or 2 an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017...

CVE-2017-14498

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by 1 the Insert Media option in the content editor or 2 an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017...

PT-2017-13489

Name of the Vulnerable Software and Affected Versions SilverStripe CMS versions prior to 3.6.1 Description The issue concerns a mishandled SVG document, which can lead to XSS. This occurs through either the Insert Media option in the content editor or an admin/assets/add pathname. An example of...

JCE - A Content Editor for Joomla, 2.5.0, 2.5.1, 2.5.2

JCE - A Content Editor for Joomla, vulnerable versions: 2.5.0, 2.5.1, 2.5.2, Vulnerability type: other Resolution: update to version 2.5.3 Update Notice URL https://www.joomlacontenteditor.net/news/item/jce-253-released Developer says that versions prior to 2.5.0 do not appear to be affected, but...

JCE - Joomla Content Editor 2.4.5 and previous

Versions 2.4.5 and previous Update to Version 2.4.6 improves security in add-on installation system UpdateNoticeURL https://www.joomlacontenteditor.net/news/item/jce-246-released...

Meditate Web Content Editor 'username_input' SQL-Injection vulnerability

No description provided by source. Advisory: Meditate Web Content Editor 'usernameinput' SQL-Injection vulnerability Advisory ID: SSCHADV2011-039 Author: Stefan Schurtz Affected Software: Successfully tested on Meditate 1.2 Vendor URL: http://www.arlomedia.com/ Vendor Status: fixed...

Joomla Content Editor Malicious User Agent Code Execution

Joomla Content Editor JCE is an extension for Joomla which provides a set of web content editing tools. An attacker may use a malicious user agent to compromise security on systems with JCE installed...

Joomla, WordPress Sites Hit by IFrame Injection Attacks

Users of the popular Joomla content management system are being urged by security experts to upgrade to the latest version after reports of exploits being used to compromise websites built on the platform. The SANS Internet Storm Center received numerous reports that Joomla sites, as well as...

CVE-2012-2901

Cross-site scripting XSS vulnerability in the Profile List in the Joomla Content Editor JCE component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php...

CVE-2012-2902

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor JCE component before 2.1 for Joomla!, when chunking is set to greater than zero, allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension as...

Cross site scripting

Cross-site scripting XSS vulnerability in the Profile List in the Joomla Content Editor JCE component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php...

Unrestricted file upload

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor JCE component before 2.1 for Joomla!, when chunking is set to greater than zero, allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension as...

CVE-2012-2901

CVE-2012-2901 describes a cross-site scripting (XSS) vulnerability in the Joomla Content Editor (JCE) component’s Profile List, affecting Joomla! installations using JCE prior to version 2.1. The flaw allows remote attackers to inject arbitrary scripts/HTML via the search parameter sent to admini...