CVE-2020-9743 HTML injection in AEM's content editor component

AEM versions 6.5.5.0 and below, 6.4.8.1 and below, 6.3.3.8 and below and 6.2 SP1-CFP20 and below are affected by an HTML injection vulnerability in the content editor component that allows unauthenticated users to craft an HTTP request that includes arbitrary HTML code in a parameter value. An...

CVE-2020-9743

CVE-2020-9743 is an HTML injection vulnerability in Adobe Experience Manager’s content editor. Affected are AEM 6.5.5.0 and earlier, 6.4.8.1 and earlier, 6.3.3.8 and earlier, and 6.2 SP1-CFP20 and earlier. The issue allows unauthenticated users to craft a request that injects arbitrary HTML, enab...

CVE-2019-19682

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/id Admin/Blog/BlogPostEdit/id. NOTE: the...

Cross site scripting

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/id Admin/Blog/BlogPostEdit/id. NOTE: the...

CVE-2019-19682

nopCommerce

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting

Sitecore 9.0 rev 171002 - Persistent Cross-Site Scripting Exploit Title: Stored Cross Site Scripting XSS in Sitecore 9.0 rev 171002 Date: July 11, 2019 Exploit Author: Owais Mehtab Vendor Homepage: http://www.sitecore.net/en Version: 9.0 rev. 171002 Tested on: Sitecore Experience Platform 8.1...

Joomla Content Editor Com_JCE Component Information Disclosure Vulnerability

Joomla is an open source content management system CMS. An information disclosure vulnerability exists in the Joomla Content Editor ComJCE component. An attacker can exploit the vulnerability to obtain database backup information...

Description of the security update for SharePoint Server 2013: July 10, 2018

Description of the security update for SharePoint Server 2013: July 10, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microsoft...

Description of the security update for SharePoint Foundation 2013: July 10, 2018

Description of the security update for SharePoint Foundation 2013: July 10, 2018 Summary This security update resolves vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted Office file. To learn more about these vulnerabilities, see Microso...

Cross-site Scripting (XSS) Through SVG Documents

silverstripe/installer and silverstripe/framework are vulnerable to cross-site scripting XSS attacks. These attacks are possible because the Insert Media option within the content editor, and the pathname in admin/assests/add allow attackers to insert SVG documents containing arbitrary javascript...

Code injection

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by 1 the Insert Media option in the content editor or 2 an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017...

JCE - A Content Editor for Joomla, 2.5.0, 2.5.1, 2.5.2

JCE - A Content Editor for Joomla, vulnerable versions: 2.5.0, 2.5.1, 2.5.2, Vulnerability type: other Resolution: update to version 2.5.3 Update Notice URL https://www.joomlacontenteditor.net/news/item/jce-253-released Developer says that versions prior to 2.5.0 do not appear to be affected, but...

JCE - Joomla Content Editor 2.4.5 and previous

Versions 2.4.5 and previous Update to Version 2.4.6 improves security in add-on installation system UpdateNoticeURL https://www.joomlacontenteditor.net/news/item/jce-246-released...

Meditate Web Content Editor 'username_input' SQL-Injection vulnerability

No description provided by source. Advisory: Meditate Web Content Editor 'usernameinput' SQL-Injection vulnerability Advisory ID: SSCHADV2011-039 Author: Stefan Schurtz Affected Software: Successfully tested on Meditate 1.2 Vendor URL: http://www.arlomedia.com/ Vendor Status: fixed...

Joomla Content Editor Malicious User Agent Code Execution

Joomla Content Editor JCE is an extension for Joomla which provides a set of web content editing tools. An attacker may use a malicious user agent to compromise security on systems with JCE installed...

Joomla, WordPress Sites Hit by IFrame Injection Attacks

Users of the popular Joomla content management system are being urged by security experts to upgrade to the latest version after reports of exploits being used to compromise websites built on the platform. The SANS Internet Storm Center received numerous reports that Joomla sites, as well as...

CVE-2012-2902

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor JCE component before 2.1 for Joomla!, when chunking is set to greater than zero, allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension as...

CVE-2012-2901

Cross-site scripting XSS vulnerability in the Profile List in the Joomla Content Editor JCE component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php...

Unrestricted file upload

Unrestricted file upload vulnerability in editor/extensions/browser/file.php in the Joomla Content Editor JCE component before 2.1 for Joomla!, when chunking is set to greater than zero, allows remote authors to execute arbitrary PHP code by uploading a PHP file with a double extension as...

Cross site scripting

Cross-site scripting XSS vulnerability in the Profile List in the Joomla Content Editor JCE component before 2.1 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the search parameter to administrator/index.php...