CVE-2024-27592

Open Redirect vulnerability in Corezoid Process Engine v6.5.0 allows attackers to redirect to arbitrary websites via appending a crafted link to /login/ in the login page URL...

PT-2024-24338 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 13.9-rc-1 through 4.10.18 XWiki Platform versions 13.9-rc-1 through 15.5.3 XWiki Platform versions 13.9-rc-1 through 15.10-rc-1 Description: The XWiki Platform is a generic wiki platform that allows arbitrary remote co...

savignano S/Notify 安全漏洞

savignano S/Notify is savignano's most versatile email encryption solution for Jira, Confluence and Bitbucket. A security vulnerability exists in savignano S/Notify versions prior to 2.0.1 that stems from the presence of a cross-site request forgery vulnerability that allows an attacker to replac...

CVE-2024-25708

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2024-25709

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS versions 11.2 and below that may allow a remote, authenticated attacker to create a crafted link that can be saved as a new location when moving an existing item, which could potentially execute arbitrary JavaScrip...

CVE-2024-25705

There is a cross‑site scripting XSS vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary...

CVE-2024-25705

There is a cross‑site scripting XSS vulnerability in Esri Portal for ArcGIS Experience Builder versions 11.1 and below on Windows and Linux that allows a remote, authenticated attacker with low‑privileged access to create a crafted link which, when clicked, could potentially execute arbitrary...

CVE-2024-25698

There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the...

CVE-2024-25697

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser. The privileges required to execute...

CVE-2024-25697

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link which when opening an authenticated users bio page will render an image in the victims browser. The privileges required to execute...

CVE-2024-25696

There is a Cross-site Scripting vulnerability in Portal for ArcGIS in versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when accessing the page editor an image will render in the victim’s browser. The privileges required to execute this attack...

CVE-2024-25690

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...

CVE-2024-25690

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...

CVE-2024-25704

CVE-2024-25704 entry is rejected/not used; this CVE ID is not an active vulnerability entry.

CVE-2024-25705

CVE-2024-25705 describes a cross-site scripting issue in Esri Portal for ArcGIS Experience Builder versions 11.1 and below. The CVE record states exploitation requires basic authenticated access (low-privilege), while a PT-Security entry notes a remote, unauthenticated attacker scenario; there is...

CVE-2024-25703

CVE-2024-25703 is rejected/not used; this entry does not represent an active vulnerability.

CVE-2024-25709

Mode C: Normal details available CVE-2024-25709 is a stored Cross-Site Scripting (XSS) vulnerability affecting Esri Portal for ArcGIS. The connected PTSecurity advisory specifies affected versions: Esri Portal for ArcGIS 10.8.1 through 10.8.1 – 1121. The issue allows a remote attacker to craft a ...

CVE-2024-25700

The CVE concerns Esri Portal for ArcGIS Enterprise Web App Builder (versions 11.1 and below). A stored Cross-site Scripting (XSS) condition can arise when an attacker with high privileges creates a crafted link stored in a web map; when clicked, it could execute arbitrary JavaScript in the victim...

CVE-2024-25698

CVE-2024-25698 is a reflected cross-site scripting vulnerability in the Esri Portal for ArcGIS Home application for version 11.1 and earlier, running on Windows or Linux. An unauthenticated remote attacker could craft a link that, when clicked, may execute arbitrary JavaScript in the victim’s bro...

CVE-2024-25698 Reflected XSS in Portal for ArcGIS

There is a reflected cross site scripting vulnerability in the home application in Esri Portal for ArcGIS 11.1 and below on Windows and Linux that allows a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the...