16199 matches found
CVE-2023-3971
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise...
Red Hat Ansible automation controller 跨站脚本漏洞
Red Hat Ansible automation controller is a centralized management tool from Red Hat, Inc. It is used for managing inventory, initiating and scheduling workflows, tracking changes, and integrating reports with a centralized user interface. A security vulnerability exists in the Red Hat Ansible...
Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by multiple vulnerabilities in Golang Go
Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Golang Go. The below vulnerabilities have been addresssed. Vulnerability Details CVEID:CVE-2023-24534 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an memory exhaustion in t...
Stored html injection on segment name
Description I have found an HTML Injection vulnerability on your web application. HTML injection is a type of injection vulnerability that occurs when a user is able to control an input point and is able to inject arbitrary HTML code into a vulnerable web page. Note : I am recreating the report a...
CVE-2023-33229
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML...
The vulnerability of the SAP NetWeaver Design Time Repository, a software integration platform, allows a hacker to inject arbitrary HTML code.
The vulnerability of the SAP NetWeaver Design Time Repository software platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code remotely...
PT-2023-24234 · Solarwinds · Solarwinds Platform
Name of the Vulnerable Software and Affected Versions: SolarWinds Platform affected versions not specified Description: The issue allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML, due to incorrect input neutralization...
Security Bulletin: IBM Event Streams is affected by multiple Golang Go vulnerabilities
Summary There are a number of vulnerabilities in Golang Go used by IBM Event Streams CVE-2023-29400, CVE-2023-24540, CVE-2023-24539, CVE-2023-24536, CVE-2023-24537, CVE-2023-24538. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Go is vulnerable ...
Cisco Small Business SPA500 Series IP Phones HTML Injection Vulnerability
Cisco Small Business SPA500 Series IP Phones is an SPA500 series IP phone from Cisco USA. The Cisco Small Business SPA500 Series IP Phones suffer from an HTML injection vulnerability that can be exploited by an attacker to redirect users to potentially malicious websites by convincing them to cli...
Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Create a Blank form or select...
Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Create a Blank form or select conta...
HTML Injection
gitlab is vulnerable to HTML Injection. The vulnerability exists because the search timeout could be triggered if the attacker injects and execute a maliciously crafted HTML payload into the issue description...
golang: html/template: improper sanitization of CSS values
A flaw was found in golang where angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if...
Cisco Small Business SPA500 Series IP Phones 跨站脚本漏洞
Cisco Small Business SPA500 Series IP Phones is an SPA500 series IP phone from Cisco USA. The Cisco Small Business SPA500 Series IP Phones suffer from an HTML injection vulnerability that can be exploited by an attacker to redirect users to potentially malicious websites by convincing them to cli...
Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities
Exploit Title: Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities References Source: https://www.vulnerability-lab.com/getcontent.php?id=2278 Release Date: 2023-07-04 Vulnerability Laboratory ID VL-ID: 2278 Common Vulnerability Scoring System: 5.4 Product & Service Introduction:...
Cisco Small Business SPA500 Series IP Phones Web UI Vulnerabilities
Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote attacker to conduct cross-site scripting XSS or HTML injection attacks. For more information about these vulnerabilities, see the Details "details"...
LinkedIn: HTML injection at Company Name or Product Name and can be shown on Contact Sales form
A vulnerability was discovered that allowed HTML injection into the company name and product name fields on a contact sales form. Attackers could exploit this to conduct phishing attacks or distribute malware. The issue was addressed...
Active Super Shop CMS 2.5 HTML Injection
Document Title: =============== Active Super Shop CMS v2.5 - HTML Injection Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2278 Release Date: ============= 2023-07-04 Vulnerability Laboratory ID VL-ID: ==================================...
