Grafana Cross-site Scripting vulnerability

public/app/features/panel/panelctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links via the Title or url field...

Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability

Withdrawn This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references. According to maintainers of Fat Free CRM, the CRM comment feature allows certain HTML markup, but santizes the...

GHSA-GMG5-R3C4-3FM9 Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability

Withdrawn This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references. According to maintainers of Fat Free CRM, the CRM comment feature allows certain HTML markup, but santizes the...

ROS-20220524-04

The vulnerability in the Moodle course management system is due to a problem in the logic used to count of failed login attempts. Exploitation of the vulnerability could allow an attacker acting remotely to bypass the account lockout threshold. remotely to bypass the account lockout threshold A...

Fat Free CRM Cross-site Scripting vulnerability

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI...

CVE-2021-37695

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using...

CVE-2008-3823

Cross-site scripting XSS vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of a MIME attachment in an e-mail message...

CVE-2022-29183 Reflected XSS in GoCD

GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison function's error handling to render arbitrary HTML into the returned page. This could allow an attacker to trick a victim into executing co...

Acronis Cyber Protect Injection Vulnerability

Acronis Cyber Protect is an application. that provides unified protection for your network by integrating backup, disaster recovery, artificial intelligence-based malware protection, remote assistance and security into a single, reliable tool.Acronis Cyber Protect 15 Linux, Windows suffers from a...

PT-2022-13871 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0.2 through 14.8.6 GitLab CE/EE versions 14.9.0 through 14.9.4 GitLab CE/EE versions 14.10.0 through 14.10.1 Description: The issue is related to missing sanitization of data in Pipeline error messages, allowing for th...

CVE-2022-30991

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30991

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

Design/Logic Flaw

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30991 HTML injection via report name

HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...

CVE-2022-30991

CVE-2022-30991 affects Acronis Cyber Protect 15 (Linux and Windows) before build 29240. The issue is HTML injection via the report name. Connected sources confirm the affected product/version and the vulnerability class; remediation guidance is to update to a version after build 29240. Exploitati...

CVE-2022-23068

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail...

Input validation

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail...

CVE-2022-23068

CVE-2022-23068 affects ToolJet versions v0.6.0–v1.10.2. The issue is HTML injection in the invite-new-user flow: attacker-controlled first and last name fields can inject code that is reflected in the invitation email, due to insufficient input validation/filtering in those fields. Root cause cit...

CVE-2022-23068 ToolJet - HTML Injection in Invite New User

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail...

CVE-2022-23068 ToolJet - HTML Injection in Invite New User

ToolJet versions v0.6.0 to v1.10.2 are vulnerable to HTML injection where an attacker can inject malicious code inside the first name and last name field while inviting a new user which will be reflected in the invitational e-mail...