367 matches found
Input validation
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...
CVE-2022-42960
CVE-2022-42960 concerns the EqualWeb Accessibility Widget. The connected sources confirm a DOM XSS vulnerability in the widget due to improper validation of message events within accessibility.js. Affected versions include 2.0.0 through 4.0.1 (exact sub-versions listed in the public records). The...
CVE-2022-42960
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...
CVE-2022-42960
EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js...
Adobe: DOM XSS at `https://adobedocs.github.io/OAE_PartnerAPI/?configUrl={site}` due to outdated Swagger UI
Vulnerability description not provided...
Adobe: DOM XSS at `https://adobedocs.github.io/indesign-api-docs/?configUrl={site}` due to outdated Swagger UI
Vulnerability description not provided...
CVE-2022-36948
In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10...
Design/Logic Flaw
In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10...
CVE-2022-36948
In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10...
CVE-2022-36948
CVE-2022-36948 describes a DOM-based XSS in Veritas NetBackup OpsCenter. Affected versions are 8.x–8.3.0.2, 9.x–9.0.0.1, 9.1.x–9.1.0.1, and 10. The connected PT-2022-23695 entry provides remediation guidance: upgrade to a version later than 8.3.0.2 for 8.x, later than 9.0.0.1 for 9.x, later than ...
Cross-Site Request Forgery (CSRF)
microweber/microweber is vulnerable to cross site request forgery. The vulnerability exists due to a dom XSS in index.php because the user input for type parameter is not properly escaped which allows an attacker to steal tokens and gain access to sensitive information resulting a csrf...
Cross-site scripting - DOM
Description DOM XSS with filter bypass on /demo/module/ using type parameter without authentication. Proof of Concept...
Radancy: Admin account/panel takeOver and Doing actions in admin panel via DOM-based XSS
Hello team , I found Dom-XSS in your https://████████/ Webmail Admin Panel that manage attacker to stealing admin sensitive info and doing any action in your webmail admin panel . why and how this vulnerability happen : - if your reviewed the source code of this endpoint of the admin panel "...
CVE-2022-23077
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...
Hardcoded credentials
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...
CVE-2022-23077
Habitica (HabitRPG) versions 4.119.0–4.232.2 are affected by a DOM-based XSS on the login page. Root cause: insufficient validation/escaping of user-supplied data leading to reflected input in the DOM. Impact: cross-site scripting via the login page; potential for session/credential exposure if u...
CVE-2022-23077 Habitica - DOM XSS in login page
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...
CVE-2022-23077 Habitica - DOM XSS in login page
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page...
Elementor < 3.5.6 - DOM Reflected Cross-Site Scripting
The plugin does not sanitise and escape user input appended to the DOM via malicious Lightbox settings, resulting in a DOM Cross-Site Scripting issue PoC...