CVE-2024-38039: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.0 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser no stateful change made or customer data rendered...

CVE-2024-41514

CADClick versions 1.11.0 and before are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the PrevPgGroup.aspx page. The root cause is the improper neutralization of input, allowing remote attackers to inject arbitrary web scripts or HTML via the wer parameter. This flaw c...

CVE-2024-41513

A reflected cross-site scripting (XSS) vulnerability exists in the Artikel.aspx component of CADClick version 1.11.0 and earlier. The root cause is the improper neutralization of input, which allows remote attackers to inject arbitrary web scripts or HTML via the searchindex parameter. This allow...

CVE-2024-47617

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting XSS issue, which could potentially...

CVE-2024-47617: Improper Neutralization of Input During Web Page Generation

Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting XSS issue, which could potentially...

CVE-2024-9174

Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI...

CVE-2024-9174

Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI...

CVE-2024-9174 Stored HTML Injection in Hubshare social module

Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI...

CVE-2024-9174

CVE-2024-9174 affects M-Files Hubshare (Social Module) prior to version 5.0.8.6. It is a stored HTML injection vulnerability that allows an authenticated user to spoof the UI. Root cause: HTML injection in the Social Module; impact includes UI spoofing. The PT-Security advisory corroborates the a...

CVE-2024-9174 Stored HTML Injection in Hubshare social module

Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI...

M-Files Hubshare security vulnerabilities

M-Files Hubshare is a collaboration solution from M-Files, Inc. designed to seamlessly share files, documents and collaborative content. A security vulnerability exists in M-Files Hubshare versions prior to 5.0.8.6 that stems from the presence of an HTML injection vulnerability...

Online Eyewear Shop 1.0 Cross Site Request Forgery

============================================================================================================================================= | Title : Online Eyewear Shop v1.0 CSRF Add ADmin Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 130.0.0...

CVE-2024-9174: Improper Neutralization of Input During Web Page Generation

Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI...

PT-2024-39472

Name of the Vulnerable Software and Affected Versions M-Files Hubshare versions prior to 5.0.8.6 Description The issue allows an authenticated user to spoof the UI through stored HTML injection in the Social Module. Recommendations For versions prior to 5.0.8.6, update to version 5.0.8.6 or later...

python-twisted: Reflected XSS via HTML Injection in Redirect Response

A Cross-site scripting XSS vulnerability exists in Python-Twisted in the twisted.web.util.redirectTo function. This flaw allows an attacker to control the redirect URL, leading to reflected XSS in the HTML body of the redirect response. If exploited, a remote attacker could inject malicious HTML,...

CVE-2024-25411

A cross-site scripting XSS vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak for Multicloud Management

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for Multicloud Management version 2.3 Fix Pack 9 Vulnerability Details CVEID:CVE-2024-1135 DESCRIPTION: Gunicorn is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding headers. By sending a...

HTML Injection

Confidant is vulnerable to HTML Injection. The vulnerability is due to insufficient input validation and sanitization of user-supplied data in several endpoints of the Confidant service, allowing attackers to inject malicious scripts into the application...

CVE-2024-47226

A stored cross-site scripting XSS vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or HTML into the "Top banner" field. NOTE: Multiple third parties...

SUSE CVE-2024-8907

Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML XSS via a crafted set of UI gestures. Chromium security severity: Medium...