Apache Geronimo console 1.0 vulnerable to cross-site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 time parameter to cal2.jsp and 2 any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer. Version 1.1 contai...

Django Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request...

CVE-2022-28101

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

CVE-2022-28101

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

Design/Logic Flaw

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

CVE-2022-28101

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

CVE-2022-28101

CVE-2022-28101 affects Turtlapp Turtle Note v0.7.2.6. The issue arises in markdown parsing where the application does not filter the tag, enabling HTML injection. The NVD entry lists a base score of 6.0 (MEDIUM) in CVSS2 and 9.0 (CRITICAL) in CVSS3.1, with network attack vector, low complexity, ...

CVE-2022-28101

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

CVE-2022-29816

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...

Design/Logic Flaw

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...

CVE-2022-29816

JetBrains IntelliJ IDEA prior to 2022.1 is affected by HTML injection into IDE messages. The issue arises from injecting HTML into the IDE’s message rendering, enabling potential HTML-based content exposure. Remediation is to upgrade to IntelliJ IDEA 2022.1 or later, where the fix is applied. Off...

CVE-2022-29816

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...

PT-2022-19849 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.1 Description: The issue allows HTML injection into IDE messages. Recommendations: For versions prior to 2022.1, update to version 2022.1 or later to resolve the issue...

CVE-2022-26597

This CVE-2022-26597 affects Liferay Portal 7.3.0–7.4.0 (and Liferay DXP 7.3 before Service Pack 3) via the Layout module’s Open Graph integration. The root cause is a cross-site scripting (XSS) vulnerability that lets remote attackers inject arbitrary web script or HTML through the site name. The...

CVE-2022-27428

CVE-2022-27428 is a stored XSS in GalleryCMS v2.0, exploited via the album_name parameter in /index.php/album/add. The vulnerability arises from lack of input validation/escaping, allowing arbitrary web scripts when a crafted payload is submitted. Documents consistently describe the impact as cli...

CVE-2022-2511

Cross-site Scripting XSS vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL...

HTML Injection in Subscan view

Description HTML code is executed in the Subscan feature Proof of Concept 1. Add a scan engine: HTMLInjection 2. Go to "subdomains" for a target and add a Subscan using the scan engine. 3. Initiate a Subscan 4. View the subscan...

Lansweeper Cross-Site Scripting Vulnerability

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery, network settings scanning, etc. A cross-site scripting vulnerability exists in Lansweeper 9.1.20.2, which stems from a failure to adequately clean user-supplied data in...

CVE-2022-24864

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...