Dom-based XSS in Website Settings module in Settings

Description pimcore is vulnerable to Dom-based XSS at Name field in Website Settings module in Settings. Payload " Proof of Concept 1.Go to https://11.x-dev.pimcore.fun/admin/ and login. 2.In the left menu bar, go to Settings - Website Settings and input any text into Key field and choose a Type,...

Stored XSS in front/dashboard_helpdesk.php

Description Under the super-admin view, when adding a card to a dashboard, some more parameters are sent when the POST request is made. Those parameters later constitute an HTML div section in the response body. It is possible to modify the request, inject one of those parameters value which will...

PT-2023-17047 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: pimcore/pimcore versions prior to 10.5.19 Description: The issue is related to Cross-site Scripting XSS - DOM, which has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or...

K29500533: TMUI XSS vulnerability CVE-2022-23013

Security Advisory Description A DOM-based cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the currently logged-in user. CVE-2022-23013 Impact An attacker may exploit this...

SUSE CVE-2018-6076

Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page...

Siemens SCALANCE Improper Neutralization of Script-Related HTML Tags in a Web Page (CVE-2022-36325)

Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS. This plugin only works with Tenable.ot. Please visit...

CVE-2022-41266

CVE-2022-41266 affects SAP Commerce Webservices 2.0 (Swagger UI) across versions 1905, 2005, 2105, 2011, 2205. The root cause is a lack of proper input validation which allows malicious inputs to trigger a DOM XSS . Impact described in sources includes token theft and potential full account takeo...

@agentlab/ldkg-ui-basetable (0.1.1), @agentlab/ldkg-ui-charts (>=0.1.2, <=0.1.7) +131 more potentially affected by CVE-2022-23494 via tinymce (>=5.0.6, <=5.10.5)

tinymce NPM version =5.0.6, =0.1.2, =0.3.7, =0.1.7, =0.1.6, =0.0.1, =9.0.0-alpha.5, =0.1.2, =0.8.4, =0.5.2, =10.3.1-snapshot-1616513687673, =1.68.82, =0.65.0, =0.18.0, =0.0.1, =0.0.7 and more Source cves: CVE-2022-23494 Source advisory: OSV:GHSA-GG8R-XJWQ-4W92...

CVE-2022-23466 DOM-based cross-site scripting (XSS) in teler dashboard

teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting XSS in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard a...

CVE-2022-23466 DOM-based cross-site scripting (XSS) in teler dashboard

teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting XSS in the teler dashboard. When teler requests messages from the event stream on the /events endpoint, the log data displayed on the dashboard a...

Cross site scripting

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting XSS vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted GET request...

CVE-2022-45020

Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting XSS vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted GET request...

CVE-2022-45020

CVE-2022-45020 affects Rukovoditel v3.2.1 with a DOM-based XSS in the login component (/rukovoditel/index.php?module=users/login) that can trigger a Denial of Service via a crafted GET request. Affected software is Rukovoditel (v3.2.1); root cause is DOM-based XSS in the login endpoint; impact st...

New Vulnerability in Popular Widget Shows Risks of Third-Party Code

UPDATE: Snyk has recently addressed 2 additional vulnerabilities we have reported to them, CVE-2022-24441 and CVE-2022-22984, affecting versions of Snyk CLI before XXX, which leads to arbitrary code execution when scanning untrusted Maven or Gradle projects. Similar to CVE-2022-40764 these...

Uber: DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ]

Vulnerability description not provided...

SolarWinds Orion Platform < 2022.3 Multiple Vulnerabilities

The version of SolarWinds Orion Platform installed on the remote host is prior to 2022.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20223 advisory. - A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated...

CVE-2022-38975

EC-CUBE 4 series (versions 4.0.0–4.1.2) has a DOM-based cross-site scripting vulnerability (CWE-79) that can be triggered when an administrator visits a specially crafted page, allowing arbitrary script execution in the admin’s browser. The root cause is an unvalidated DOM path tied to admin-faci...

Security Bulletin: Content Manager Enterprise Edition with use of IBM Eclipse Help System (CVE-2013-0599, CVE-2013-0464, CVE-2013-0467)

Abstract Potential security vulnerabilities exist in the IBM Eclipse Help System that is shipped with the IBM Content Manager Enterprise Edition. Content Content: The products listed below may be affected by security vulnerabilities in the IBM Eclipse Help System. This issue is applicable only if...

CVE-2022-36325

Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...

Cross site scripting

Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...