GitLab Enterprise Edition（EE）和GitLab Community Edition（CE） 跨站脚本漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A cross-site scripting vulnerability exists in GitLab Enterprise Edition EE and GitLab...

EUVD-2021-27278

Malware in sbrugna...

EUVD-2021-17002

Malware in sbrugna...

Flowise vulnerable to XSS

Summary A XSScross-site scripting vulnerability is caused by insufficient filtering of input by web applications. Attackers can leverage this XSS vulnerability to inject malicious script code HTML code or client-side Javascript code into web pages, and when users browse these web pages, the...

CVE-2021-40089

An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...

PT-2024-31592 · Pagefind · Pagefind

Name of the Vulnerable Software and Affected Versions: Pagefind versions prior to 1.1.1 Description: A DOM Clobbering vulnerability exists in Pagefind, allowing an attacker to inject malicious HTML and escalate privileges. This occurs when an attacker can add elements to a page, such as img tags...

BIT-EJBCA-2021-40089

An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...

Django 跨站脚本漏洞

Django is the Django Foundation's set of open source Web application framework based on the Python language . The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in the Django wiki where an attacker with access to the edit page...

CVE-2021-40089

An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...

CVE-2021-40089

An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...

PT-2021-22799 · Primekey · Ejbca

Name of the Vulnerable Software and Affected Versions: PrimeKey EJBCA versions prior to 7.6.0 Description: An issue was found where the General Purpose Custom Publisher could still run even when the System Configuration setting Enable External Script Access was disabled. Although this setting...

Design/Logic Flaw

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file tha...

CVE-2021-35523

Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file tha...

NSClient++ 0.5.2.35 Remote Code Execution Exploit

This Metasploit module allows an attacker with knowledge of the admin password of NSClient++ to start a privileged shell. For this module to work, both web interface of NSClient++ and ExternalScripts feature should be enabled. This module requires Metasploit: https://metasploit.com/download Curre...

NoneCms 跨站脚本漏洞

NoneCms is a simple and compact open-source content management system that can be used to quickly build corporate sites, personal blogs, and support mobile. NoneCms 1.3.0 version of static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf cross-site scripting vulnerability. The...

Cross site scripting

Knowage Suite before 7.4 is vulnerable to cross-site scripting XSS. An attacker can inject arbitrary external script in '/knowagecockpitengine/api/1.0/pages/execute' via the 'SBIHOST' parameter...

GitLab: XSS on Issue reference numbers

Dear team, I found an XSS that occurs when users move mouse over reference numbers of issues. This XSS occurs on Firefox. It does not occurs on Webkit-based ones such as Safari, Chrome. I haven't tested on Edge. It can be also occured in older browsers due to svg4everybody and...

Rockstar Games: xss on https://www.rockstargames.com/GTAOnline/jp/screens/

In this report, the researcher identified a Cross-Site Scripting vulnerability on the /GTAOnline/jp/screens/ section of the website. Cross-Site Scripting can be exploited to steal cookies or help perform other attacks. This was possible because the page would blindly decode and attempt to load an...

Gatecoin: DOM Based XSS charting_library

Description chartinglibrary contains a DOM Based XSS vulnerability that allows to load an external JS script and execute it. PoC Open URL in any browser...

File Containment Vulnerability in Jiayuan Talent System v3.6

Jiayuan Talent System is a talent website program based on ASP+MSSQL developed by Shanghai Jiabi Network Technology Development Co. Jia Yuan Talent System v3.6 exists a file inclusion vulnerability, the vulnerability is due to the system add and execute scheduled tasks failed to effectively filte...