PT-2022-6869 · Microsoft +1 · Internet Explorer +1

Name of the Vulnerable Software and Affected Versions: angular versions prior to the fixed version Description: The issue is related to Cross-site Scripting XSS due to insecure page caching in the Internet Explorer browser, allowing interpolation of elements. This occurs because the application...

Cross-site Scripting (XSS)

Overview angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this package...

Cross-site Scripting (XSS)

Overview AngularJS.Core is an AngularJS. package for other Angular modules within .NET. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insecure page caching in the Internet Explorer browser, which allows interpolation of elements. Details Cross-site scripting ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insecure page caching in the Internet Explorer browser, which allows interpolation of elements. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicio...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

Arbitrary file deletion

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

CVE-2022-35403

Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. This also affects Asset Explorer before 6977 with authentication...

The vulnerability of the __ajax_explorer.sgi file in D-Link DIR-645 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ajaxexplorer.sgi file of the D-Link DIR-645 router microprogramming system is related to the failure to eliminate special elements used in the operating system’s processing of the QUERYSTRING parameter. Exploiting this vulnerability can allow an attacker to execute...

sidekiq: XSS via the queue name of the live-poll feature

A cross-site scripting vulnerability was found in sidekiq via the queue name of the live-poll feature. A potential attacker can impersonate or masquerade as the victim user using this vulnerability when Internet Explorer is used...

The vulnerability of the Internet Explorer browser, related to the use of memory after it is freed, allows a hacker to execute arbitrary code.

The vulnerability of the Internet Explorer browser is related to the use of memory after it is freed during the processing of objects in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created malicious web page...

The vulnerability in the CDisplayPointer class implementation of the Microsoft Internet Explorer browser allows a perpetrator to execute arbitrary code or cause a service failure.

The vulnerability of the CDisplayPointer class implementation in Microsoft Internet Explorer is related to resource management errors. Exploiting this vulnerability can allow an attacker to execute arbitrary code or cause a service failure through a specially created malicious web page...

The vulnerability of the CMshtmlEd::Exec function (mshtml.dll) in the Internet Explorer browser allows a hacker to execute arbitrary code.

The vulnerability of the CMshtmlEd::Exec function mshtml.dll in the Internet Explorer browser is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Microsoft Internet Explorer Installed

Binary data microsoftinternetexplorerinstalled.nbin...

CVE-2022-32092

D-Link DIR-645 v1.03 was discovered to contain a command injection vulnerability via the QUERYSTRING parameter at ajaxexplorer.sgi...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-30118

Title for CVE: XSS in /dashboard/system/express/entities/forms/savecontrol/GUID: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

Design/Logic Flaw

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

Design/Logic Flaw

Title for CVE: XSS in /dashboard/system/express/entities/forms/savecontrol/GUID: old browsers only.Description: When using Internet Explorer with the XSS protection disabled, editing a form control in an express entities form for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 can...

CVE-2022-30118

CVE-2022-30118 involves Cross‑Site Scripting in PortlandLabs Concrete CMS. The vulnerability lies in the /dashboard/system/express/entities/forms/save_control/[GUID] path where old browsers, specifically Internet Explorer with XSS protection disabled, can edit a form control in Concrete 8.5.7 and...