551 matches found
Cross site scripting
The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability via the name of a custom field...
CVE-2021-39117
The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability via the name of a custom field...
CVE-2021-39117
The AssociateFieldToScreens page in Atlassian Jira Server and Data Center before version 8.18.0 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability via the name of a custom field...
U.S. Dept Of Defense: Sensitive data exposure via /secure/███████ endpoint on ████████
The sensitive data exposure vulnerability in the /secure/███████ endpoint on ████████ was identified. The vulnerability allowed unauthenticated attackers to view custom field names and custom SLA names. The vulnerability was caused by CVE-2020-14179...
Textpattern Cross-Site Scripting Vulnerability
Textpattern is a free open-source content management system based on PHP and MySQL. version 4.8.1 of Textpattern contains a cross-site scripting vulnerability. An attacker can use this vulnerability to conduct cross-site scripting attacks via the "Custom" field in the "Menu Preferences" feature...
Textpattern CMS跨站脚本漏洞
Textpattern is a free open-source content management system based on PHP and MySQL. version 4.8.1 of Textpattern contains a cross-site scripting vulnerability. An attacker can use this vulnerability to conduct cross-site scripting attacks via the "Custom" field in the "Menu Preferences" feature...
CVE-2021-24365
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of...
CVE-2021-24365
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of...
CVE-2021-24365
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of...
Design/Logic Flaw
The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of...
CVE-2021-33557
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...
MantisBT 跨站脚本漏洞
MantisBT is a lightweight, free and open source, web-based defect tracking system. A cross-site scripting vulnerability exists in managecustomfieldeditpage.php in versions of MantisBT prior to 2.25.2. An attacker can exploit this vulnerability to inject code into hidden input fields...
CVE-2020-15379
Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-supplied data as name for custom field name...
Race condition
Brocade SANnav before v.2.1.0a could allow remote attackers cause a denial-of-service condition due to a lack of proper validation, of the length of user-supplied data as name for custom field name...
Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
The Admin Columns WordPress plugin allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns. When a "Custom...
Admin Columns Free (< 4.3.2) & Pro (< 5.5.2) - Authenticated Stored Cross-Site Scripting (XSS) in Custom Field
The Admin Columns WordPress plugin allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns. When a "Custom...
CVE-2020-35571
An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...
CVE-2020-35571
An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...
Code injection
An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...
CVE-2020-35571
An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...