6179 matches found
U.S. Dept Of Defense: RCE via File Upload with a Null Byte Truncated File Extension at https://██████/
A remote code execution vulnerability via file upload with a null byte truncated file extension was found on a website. By uploading a file with .asp%00.png extension, malicious ASP code could be executed on the server. This allowed an attacker to run arbitrary system commands. The issue was...
taoCMS 跨站脚本漏洞
taoCMS is a Chinese micro CMS Content Management System. A security vulnerability exists in taoCMS 3.0.2 and earlier versions, which stems from a DOM-type cross-site scripting XSS vulnerability...
CVE-2023-28534
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpjobportal WP Job Portal wp-job-portal allows DOM-Based XSS.This issue affects WP Job Portal: from n/a through = 2.0.5...
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
NOTE: rails-ujs is part of Rails/actionview since 5.1.0. There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML...
GHSA-XP5H-F8JF-RC8Q rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
NOTE: rails-ujs is part of Rails/actionview since 5.1.0. There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML...
rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements
NOTE: rails-ujs is part of Rails/actionview since 5.1.0. There is a potential DOM based cross-site scripting issue in rails-ujs which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML...
CVE-2023-30454
An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be...
Cross site scripting
An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be...
ebankIT 6 Cross Site Scripting
CVE-2023-30454 Description An issue was discovered in ebankIT before version 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the...
CVE-2023-30454: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be...
CVE-2023-30454
CVE-2023-30454 affects ebankIT before version 7, with a DOM-based XSS at the endpoint /Security/Transactions/Transactions.aspx . An attacker can supply JavaScript in the POST parameter ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray , which is passed to an internal eval...
ebankIT 跨站脚本漏洞
ebankIT is a banking software from ebankIT Portugal. A cross-site scripting vulnerability exists in versions prior to ebankIT 7. The vulnerability stems from the presence of a cross-site scripting XSS vulnerability based on the Document Object Model...
Debian: Security Advisory (DSA-5389-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
rukovoditel 3.2.1 Cross Site Scripting
Title: rukovoditel 3.2.1 - Cross-Site Scripting XSS Author: nu11secur1ty Date: 11.03.2022 Vendor: https://www.rukovoditel.net/ Software: https://sourceforge.net/projects/rukovoditel/files/rukovoditel3.2.1.zip/download Reference:...
rukovoditel 3.2.1 - Cross-Site Scripting Vulnerability
Title: rukovoditel 3.2.1 - Cross-Site Scripting XSS Author: nu11secur1ty Vendor: https://www.rukovoditel.net/ Software: https://sourceforge.net/projects/rukovoditel/files/rukovoditel3.2.1.zip/download Reference:...
rukovoditel 3.2.1 - Cross-Site Scripting (XSS)
Title: rukovoditel 3.2.1 - Cross-Site Scripting XSS Author: nu11secur1ty Date: 11.03.2022 Vendor: https://www.rukovoditel.net/ Software: https://sourceforge.net/projects/rukovoditel/files/rukovoditel3.2.1.zip/download Reference:...
10.30.npm-learning (>=1.0.0, <=1.1.0), 2017_node (1.0.0) +3303 more potentially affected by CVE-2023-26116 via angular (>=1.2.27, <=1.8.3)
angular NPM version =1.2.27, =1.0.0, =4.13.7-rc4, =1.103.1, =1.103.1, =1.102.4, =1.102.3, =1.102.3, =1.4.156, =1.0.3, =1.0.0, =1.0.0, =0.5.0, =0.5.2 and more Source cves: CVE-2023-26116 Source advisory: SNYK:JS-ANGULAR-3373044...
Dom-based XSS in Website Settings module in Settings
Description pimcore is vulnerable to Dom-based XSS at Name field in Website Settings module in Settings. Payload " Proof of Concept 1.Go to https://11.x-dev.pimcore.fun/admin/ and login. 2.In the left menu bar, go to Settings - Website Settings and input any text into Key field and choose a Type,...
Stored XSS in front/dashboard_helpdesk.php
Description Under the super-admin view, when adding a card to a dashboard, some more parameters are sent when the POST request is made. Those parameters later constitute an HTML div section in the response body. It is possible to modify the request, inject one of those parameters value which will...