10689 matches found
CVE-2020-13673
The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...
CVE-2022-23321
A persistent cross-site scripting XSS vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0...
CVE-2022-23321
A persistent cross-site scripting XSS vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0...
CVE-2022-23321
A persistent cross-site scripting XSS vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0...
Cross site scripting
A persistent cross-site scripting XSS vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0...
CVE-2022-23321
A persistent cross-site scripting XSS vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0...
PT-2022-15929 · Xmpie · Xmpie Ustore
Name of the Vulnerable Software and Affected Versions: XMPie UStore version 12.3.7244.0 Description: A persistent cross-site scripting XSS issue exists in the administrative panel when editing users, specifically affecting two input fields. Recommendations: For version 12.3.7244.0, consider...
XMPie UStore 跨站脚本漏洞
Xmpie Ustore is a network printing solution from Xmpie USA. A security vulnerability exists in the XMPie UStore application that stems from a persistent cross-site scripting XSS vulnerability in two input fields in the admin panel when editing a user in the XMPie UStore application, version...
CVE-2021-24879
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsctickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter stored...
CVE-2022-0474
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions...
CVE-2022-0473
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions...
CVE-2022-0473
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions...
CVE-2022-0474
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions...
CVE-2022-0473
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions...
CVE-2022-0474
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions...
OTRS 信息泄露漏洞
OTRS AG OTRSCustomContactFields is an OTRS custom contact fields plugin from OTRS Germany.An information disclosure vulnerability exists in OTRS AG OTRSCustomContactFields, which could be exploited by an attacker to obtain the full list of recipients in a contact field from a customer...
Business Logic Flaws
dolibarr has business logic flaws. The vulnerability exists due to a lack of sanitization of values for the Weight, Length x Width x Height, Area, Volume fields of a Product...
CVE-2022-24300
Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection...