16060 matches found
Design/Logic Flaw
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the groupprefix field during the creation of a new group via "Copy" method at usergroupadmin.php...
CVE-2021-3816
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the groupprefix field during the creation of a new group via "Copy" method at usergroupadmin.php...
CVE-2021-23225
CVE-2021-23225 (Cacti 1.1.38) : An authenticated user with User Management permissions can inject arbitrary web script or HTML in the “new_username” field when creating a new user via the Copy method in user_admin.php. The vulnerability’s impact is described as cross-site scripting (XSS). Debian'...
CVE-2021-3816
CVE-2021-3816 affects Cacti 1.1.38. An authenticated user with User Management permissions can inject arbitrary HTML into the group_prefix field when creating a new group via the Copy method in user_group_admin.php. This constitutes an HTML injection vulnerability in the group creation workflow. ...
CVE-2021-3816
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the groupprefix field during the creation of a new group via "Copy" method at usergroupadmin.php...
CVE-2021-3816
Cacti 1.1.38 allows authenticated users with User Management permissions to inject arbitrary HTML in the groupprefix field during the creation of a new group via "Copy" method at usergroupadmin.php...
Multiple XSS and HTML injection attacks in setup script
PMASA-2022-2 Announcement-ID: PMASA-2022-2 Date: 2022-01-10 Summary Multiple XSS and HTML injection attacks in setup script Description A series of weaknesses has been discovered that could allow an attacker to inject malicious code in to aspects of the setup script, which can allow XSS or HTML...
Mattermost: html injection via invite members can be leads account takeover
An HTML injection vulnerability was found on the website that allowed an attacker to inject HTML code into an email invitation sent to a victim. This could lead to the victim being redirected to a malicious site or tricked into giving away login credentials...
CVE-2021-46079
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection...
CVE-2021-46079
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection...
Unrestricted file upload
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection...
CVE-2021-46079
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection...
CVE-2021-46079
CVE-2021-46079 affects Sourcecodester Vehicle Service Management System 1.0. The vulnerability is an unrestricted file upload that enables a remote attacker to upload malicious files, leading to HTML injection . Multiple sources (NVD, Red Hat, CVE lists) corroborate this description. The availabl...
Careful! Uber flaw allows anyone to send an email from uber.com
On New Years Eve, Seif Elsallamy @0x21SAFE on Twitter, a bug bounty hunter and security researcher, pointed out a phish-worthy security flaw he found on Uber’s email system. The flaw allowed anyone to send emails on behalf of Uber, meaning they would end with "@uber.com", just like the one below:...
Dolibarr has unspecified vulnerabilities
Dolibarr is an application. A modern software package that helps manage your organization's activities. a security vulnerability exists in Dolibarr, which stems from allowing HTML injection in admin limits.php in Dolibarr 7.0.2. No details of the vulnerability are currently available...
HTML Injection
dolibarr/dolibarr is vulnerable to HTML injection. If there is no canonical URL defined during setup, a malicious user can initiate a POST request with any domain name in the HOST header, allowing for arbitrary domains to be set for certain links...
CVE-2021-43942
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting XSS vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting...
8x8: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The researcher found a possible HTML injection in one of our demo system webpages caused by improper sanitisation of input data. The issue was swiftly resolved...
