CVE-2021-44217

CVE-2021-44217 建议描述 在 Ericsson CodeChecker 直至 6.18.0 版本中， 报告查看器的评论组件存在存储型跨站脚本 XSS 漏洞， 允许远程攻击者通过 /CodeCheckerService API 的 POST JSON 数据注入任意 Web 脚本或 HTML。 附加信息 CodeChecker Web 服务器具有权限系统，可隔离具有不同权限的用户。 并且它还将每个用户的 cookie 存储在 document.cookie 中。 因此，低权限攻击者（例如访客账户）可以利用此漏洞窃取超级用户的秘密 cookie 或 通过控制受害者请求某些数据获取...

PYSEC-2026-625 Cross-site Scripting in Ericsson CodeChecker

In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

EUVD-2022-0591

Malicious code in bioql PyPI...

CVE-2021-44217

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

PYSEC-2022-43181

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

Cross site scripting

In Ericsson CodeChecker through 6.18.0, a Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API...

Ericsson CodeChecker 跨站脚本漏洞

Codechecker is an analysis tool, defect database and viewer extension for Clang Static Analyzer and Clang Tidy. A security vulnerability exists in Ericsson CodeChecker before 6.18.0 that allows remote attackers to inject arbitrary web script or HTML via POST JSON data from the /CodeCheckerService...

PT-2022-12020

Name of the Vulnerable Software and Affected Versions Ericsson CodeChecker versions prior to 6.18.2 Description A Stored Cross-site scripting XSS vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of...