Highcharts cross-site scripting vulnerability

Highcharts versions 2.0.0 through 3.2.0 contain a cross-site scripting vulnerability. This flaw arises from the lack of validation of the URL scheme when applying credits.href to the credits link. Attackers can exploit this by controlling the Grid configuration to supply a JavaScript URL. When th...

Stored cross site scripting vulnerability in operator any getter in pimcore grid configuration

Description Stored cross site scripting vulnerability in operator any getter in pimcore grid configuration. Proof of Concept 1. Login to the demo account https://11.x-dev.pimcore.fun/admin/login 2. On left side menu go to document -- perspective -- cdp...