Firefly III allows webhooks HTML Injection.

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

Design/Logic Flaw

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...

Firefly III Security Vulnerability

Firefly III is an open source personal finance management system. A security vulnerability exists in Firefly III before 6.1.1, which stems from allowing webhooks HTML injection...

PT-2024-19186 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 6.1.1 Description: The issue allows for HTML injection in webhooks. It is related to a Client-Side Path Traversal CSPT vulnerability, which can be used to control data that was assumed to be uncontrollable. This...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

CVE-2024-22075

Firefly III aka firefly-iii before 6.1.1 allows webhooks HTML Injection...

GHSA-GJHC-6XM7-MC8Q Duplicate Advisory: Cross-site scripting vulnerability in TinyMCE

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h9g-x5rv-25wg. This link is maintained to preserve external references. Original Description TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and...

UBUNTU-CVE-2024-21908

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser...

CVE-2024-21908 Cross-site scripting vulnerability in TinyMCE

TinyMCE versions before 5.9.0 are affected by a stored cross-site scripting vulnerability. An unauthenticated and remote attacker could insert crafted HTML into the editor resulting in arbitrary JavaScript execution in another user's browser...

CVE-2024-21908

Removed by vendor...

Tiny Technologies TinyMCE Cross-Site Scripting Vulnerability

Tiny Technologies TinyMCE is a rich text editor from Tiny Technologies, USA. A cross-site scripting vulnerability exists in Tiny Technologies TinyMCE prior to version 5.6.0, which originated from a vulnerability that could allow a remote attacker to insert crafted HTML into the editor, resulting ...

GitLab 12.6 < 14.3.6 / 14.4 < 14.4.4 / 14.5 < 14.5.2 (CVE-2021-39910)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. GitL...

Security Bulletin: Multiple vulnerabilities in Golang Go affect Cloud Pak System

Summary Vulnerabilities in Golang Go affect Cloud Pak System Software. IBM Cloud Pak System has addresssed vulnerabilities. Vulnerabilities include code execution, HTML injection, denial of service, privilege escalation, P256 Curve unspecified, and obtaining sensitive information as described by...

TikTok: HTML Injection on TikTok Ads

A HTML injection vulnerability was found in a TikTok Ads endpoint. The vulnerability could have allowed arbitrary HTML or phishing content to be injected. The issue was responsibly disclosed...

Kantega SAML SSO OIDC Kerberos Security Vulnerability

Kantega SAML SSO OIDC Kerberos is an authentication plug-in from Kantega. A security vulnerability exists in Kantega SAML SSO OIDC Kerberos versions 4.4.2 through 4.14.8, 5.0.0 through 5.11.4, and 6.0.0 through 6.19.0, which stems from incorrect URL parameter cleanup that allows for HTML injectio...

CVE-2023-48003

An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the 'meta http-equiv="refresh"' in the WebSocket messages...

CVE-2023-48003

An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the '...