6177 matches found
CVE-2022-45020
Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting XSS vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted GET request...
CVE-2022-45020: Improper Neutralization of Input During Web Page Generation
Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting XSS vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted GET request...
Rukovoditel 跨站脚本漏洞
Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software features project management, customer relationship management, and more. Rukovoditel v3.2.1 version of a security vulnerability , the vulnerability stems from the inclusion of DOM-bas...
CVE-2022-45020
CVE-2022-45020 affects Rukovoditel v3.2.1 with a DOM-based XSS in the login component (/rukovoditel/index.php?module=users/login) that can trigger a Denial of Service via a crafted GET request. Affected software is Rukovoditel (v3.2.1); root cause is DOM-based XSS in the login endpoint; impact st...
New Vulnerability in Popular Widget Shows Risks of Third-Party Code
UPDATE: Snyk has recently addressed 2 additional vulnerabilities we have reported to them, CVE-2022-24441 and CVE-2022-22984, affecting versions of Snyk CLI before XXX, which leads to arbitrary code execution when scanning untrusted Maven or Gradle projects. Similar to CVE-2022-40764 these...
Uber: DOM based XSS via insecure parameter on [ https://uberpay-mock-psp.uber.com ]
Vulnerability description not provided...
CVE-2022-36965: Improper Neutralization of Input During Web Page Generation
Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform 2022.3.0...
SolarWinds Orion Platform < 2022.3 Multiple Vulnerabilities
The version of SolarWinds Orion Platform installed on the remote host is prior to 2022.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20223 advisory. - A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated...
Cross site scripting
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series EC-CUBE 4.0.0 to 4.1.2 allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page...
CVE-2022-38975
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series EC-CUBE 4.0.0 to 4.1.2 allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page...
CVE-2022-38975
EC-CUBE 4 series (versions 4.0.0–4.1.2) has a DOM-based cross-site scripting vulnerability (CWE-79) that can be triggered when an administrator visits a specially crafted page, allowing arbitrary script execution in the admin’s browser. The root cause is an unvalidated DOM path tied to admin-faci...
CVE-2022-38975: Improper Neutralization of Input During Web Page Generation
DOM-based cross-site scripting vulnerability in EC-CUBE 4 series EC-CUBE 4.0.0 to 4.1.2 allows a remote attacker to inject an arbitrary script by having an administrative user of the product to visit a specially crafted page...
Security Bulletin: IBM OmniFind Enterprise Edition and IBM Content Analytics (CVE-2013-0599, CVE-2013-0464, CVE-2013-0467)
Abstract Potential security vulnerabilities exist in the IBM Eclipse Help System that is shipped with the IBM OmniFind Enterprise Edition and IBM Content Analytics products. Content The products listed below may be affected by security vulnerabilities in the IBM Eclipse Help System. This issue is...
Security Bulletin: Content Manager Enterprise Edition with use of IBM Eclipse Help System (CVE-2013-0599, CVE-2013-0464, CVE-2013-0467)
Abstract Potential security vulnerabilities exist in the IBM Eclipse Help System that is shipped with the IBM Content Manager Enterprise Edition. Content Content: The products listed below may be affected by security vulnerabilities in the IBM Eclipse Help System. This issue is applicable only if...
EC-CUBE 跨站脚本漏洞
EC-CUBE is an open source e-commerce system from the Japanese company EC-CUBE. A security vulnerability exists in EC-CUBE versions 4.0.0 through 4.1.2, which stems from a DOM-based cross-site scripting vulnerability that could allow a remote attacker to execute arbitrary script on the...
CVE-2022-36325
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...
Cross site scripting
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...
CVE-2022-36325
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...
CVE-2022-36325: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with administrative privileges to inject code and lead to a DOM-based XSS...
