PT-2022-13907 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs/gogs versions prior to 0.12.7 Description: The issue is a stored XSS bug in the gogs/gogs GitHub repository. This bug allows the execution of any JavaScript code in a victim's account. The vulnerability is triggered when a user opens an...

Remote Code Execution (RCE)

chrome is vulnerable to remote code execution. The vulnerability exists due to Insufficient data validation in Dev Tools which allows an attacker to bypass content security policy via a malicious HTML page...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when CSP headers were only sent along with responses that Rails considered as "HTML" responses. This left API requests without CSP headers, which could possibly expose users to this vulnerability. Workaround: Se...

PT-2022-15536 · Ruby On Rails +2 · Action Pack +2

Name of the Vulnerable Software and Affected Versions: Action Pack versions 5.2.0 through 5.2.7 Action Pack versions 6.0.0 through 6.0.4.7 Action Pack versions 6.1.0 through 6.1.5.0 Action Pack versions 7.0.0 through 7.0.2.3 Description: The issue allows an attacker to bypass Content Security...

CVE-2022-28244

Acrobat Reader DC versions 22.001.20085 and earlier, 20.005.3031x and earlier and 17.012.30205 and earlier is affected by a violation of secure design principles through bypassing the content security policy, which could result in an attacker sending arbitrarily configured requests to the...

Persistent Cross-site Scripting vulnerability in PrivateBin

In PrivateBin polygon id="triangle" points="0,0 0,50 50,0" fill="00990...

Adobe Reader < 17.012.30227 / 20.005.30331 / 22.001.20112 Multiple Vulnerabilities (APSB22-16) (macOS)

The version of Adobe Reader installed on the remote macOS host is a version prior to 17.012.30227, 20.005.30331, or 22.001.20112. It is, therefore, affected by multiple vulnerabilities. - Adobe Acrobat Reader version 22.001.20085 and earlier, 20.005.30314 and earlier and 17.012.30205 and earlier...

Adobe Reader < 17.012.30227 / 20.005.30331 / 22.001.20112 Multiple Vulnerabilities (APSB22-16)

The version of Adobe Reader installed on the remote Windows host is a version prior to 17.012.30227, 20.005.30331, or 22.001.20112. It is, therefore, affected by multiple vulnerabilities. - Adobe Acrobat Reader version 22.001.20085 and earlier, 20.005.30314 and earlier and 17.012.30205 and earlie...

Adobe Acrobat < 17.012.30227 / 20.005.30331 / 22.001.20112 Multiple Vulnerabilities (APSB22-16)

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 17.012.30227, 20.005.30331, or 22.001.20112. It is, therefore, affected by multiple vulnerabilities. - Adobe Acrobat Reader version 22.001.20085 and earlier, 20.005.30314 and earlier and 17.012.30205 and earli...

Adobe Acrobat < 17.012.30227 / 20.005.30331 / 22.001.20112 Multiple Vulnerabilities (APSB22-16) (macOS)

The version of Adobe Acrobat installed on the remote macOS host is a version prior to 17.012.30227, 20.005.30331, or 22.001.20112. It is, therefore, affected by multiple vulnerabilities. - Adobe Acrobat Reader version 22.001.20085 and earlier, 20.005.30314 and earlier and 17.012.30205 and earlier...

CVE-2022-24833

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

Cross site scripting

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

CVE-2022-24833 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

CVE-2022-24833 Persistent Cross-site Scripting (XSS) vulnerability in PrivateBin

PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin v1.4.0 a cross-site scripting XSS vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called...

UPS VDP: Reflected XSS on https://wwwapps.ups.com/ctc/request?loc=

Summary: ========= Detalis XSS ----------- Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a...

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus

Impact Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run an...

CVE-2022-24814

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

Design/Logic Flaw

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...

CVE-2022-24814

Directus XSS in Rich Text HTML interface: prior to v9.7.0, an iframe that links to an uploaded HTML file can load a second uploaded JS file, bypassing CSP and allowing arbitrary JS execution. Root cause: unsafe handling of embedded JS via WYSIWYG content. Impact: unauthorized JS execution within ...

CVE-2022-24814 Cross-site Scripting in Directus

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript JS can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script ta...