DEBIAN-CVE-2021-32862

The GitHub Security Lab discovered sixteen ways to exploit a cross-site scripting vulnerability in nbconvert. When using nbconvert to generate an HTML version of a user-controllable notebook, it is possible to inject arbitrary HTML which may lead to cross-site scripting XSS vulnerabilities if the...

CVE-2022-23620

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

GHSA-7PH6-5CMQ-XGJQ Path traversal in xwiki-platform-skin-skinx

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with...

CVE-2022-23620 Path traversal in xwiki-platform-skin-skinx

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

CVE-2022-23620

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

CVE-2022-23620 Path traversal in xwiki-platform-skin-skinx

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

CVE-2022-23620: Improper Limitation of a Pathname to a Restricted Directory

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

PT-2022-16134 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.6-rc-1 Description: The issue arises from the AbstractSxExportURLFactoryActionHandlerprocessSx function not properly escaping SSX document references when serializing them on the filesystem. This allows the...

CVE-2020-7776

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is...

Headless, Unattended Scanning in Burp Suite Professional 2.0 with Seltzer

Burp Suite Professional Burp is one of the best tools available for penetration testers. It is feature-rich, intuitive, well-supported, and customizable. However, it can be difficult to use Burp for headless, unattended scanning. Alternatives such as Burp Suite Enterprise exist, but those of us...

WS-2015-0070

In OpenRefine, versions 2.0 through 2.6-rc2 are vulnerable to Cross-Site Scripting, due to the ‘&' ampersand character not escaped when exporting cell values to HTML. An attacker could enter a crafted cell value to trigger arbitrary javascript code on a victim’s browser...

CVE-2014-3948

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3948

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3948

CVE-2014-3948 applies to the TYPO3 powermail extension. The HTML export wizard in the powermail backend module is affected by a cross-site scripting (XSS) vulnerability in versions up to 1.6.10, allowing remote attackers to inject arbitrary script via unspecified vectors. A fixed release is 1.6.1...

CVE-2014-3948

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3948: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2014-5628

Name of the Vulnerable Software and Affected Versions TYPO3 powermail extension versions prior to 1.6.11 Description A cross-site scripting XSS issue exists in the HTML export wizard of the powermail extension's backend module, allowing remote attackers to inject arbitrary web script or HTML...

Arbitrary code execution in extension "powermail" (powermail)

It has been discovered that the extension "powermail" powermail is susceptible to arbitrary code execution and Cross-Site Scripting Release Date: May 22, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: powermail:...

Arbitrary file creation in AbstractRendererExporterImpl

To reproduce: 1. Create a new space. 2. Create a new page. 3. Attach a file called test.txt to the page. 3. Edit the page, and add an image with the URL: code /confluence/s/download/attachments/pageid//../../../../../../../../../../../../tmp/test.txt code \pageid\ must be replaced with the actual...