20192 matches found
GHSA-9M48-54PJ-H248 Improper Neutralization of Input During Web Page Generation in Jenkins
A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages...
GHSA-7PHR-6CC9-4M5Q Grafana Cross-site Scripting vulnerability
public/app/features/panel/panelctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links via the Title or url field...
Grafana Cross-site Scripting vulnerability
public/app/features/panel/panelctrl.ts in Grafana before 6.2.5 allows HTML Injection in panel drilldown links via the Title or url field...
Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability
Withdrawn This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references. According to maintainers of Fat Free CRM, the CRM comment feature allows certain HTML markup, but santizes the...
GHSA-GMG5-R3C4-3FM9 Withdrawn Advisory: Fat Free CRM Cross-site Scripting vulnerability
Withdrawn This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references. According to maintainers of Fat Free CRM, the CRM comment feature allows certain HTML markup, but santizes the...
ROS-20220524-04
The vulnerability in the Moodle course management system is due to a problem in the logic used to count of failed login attempts. Exploitation of the vulnerability could allow an attacker acting remotely to bypass the account lockout threshold. remotely to bypass the account lockout threshold A...
Fat Free CRM Cross-site Scripting vulnerability
HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI...
CVE-2021-37695
ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 Fake Objects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using...
CVE-2008-3823
Cross-site scripting XSS vulnerability in MIME/MIME/Contents.php in the MIME library in Horde 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via the filename of a MIME attachment in an e-mail message...
CVE-2022-29183 Reflected XSS in GoCD
GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison function's error handling to render arbitrary HTML into the returned page. This could allow an attacker to trick a victim into executing co...
CVE-2022-29183: Improper Neutralization of Input During Web Page Generation
GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison function's error handling to render arbitrary HTML into the returned page. This could allow an attacker to trick a victim into executing co...
CVE-2022-1416
Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling...
Acronis Cyber Protect Injection Vulnerability
Acronis Cyber Protect is an application. that provides unified protection for your network by integrating backup, disaster recovery, artificial intelligence-based malware protection, remote assistance and security into a single, reliable tool.Acronis Cyber Protect 15 Linux, Windows suffers from a...
CVE-2022-1416: Improper Neutralization of Input During Web Page Generation
Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling...
PT-2022-13871 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 1.0.2 through 14.8.6 GitLab CE/EE versions 14.9.0 through 14.9.4 GitLab CE/EE versions 14.10.0 through 14.10.1 Description: The issue is related to missing sanitization of data in Pipeline error messages, allowing for th...
CVE-2022-30991
HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...
CVE-2022-30991
HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...
Design/Logic Flaw
HTML injection via report name. The following products are affected: Acronis Cyber Protect 15 Linux, Windows before build 29240...
CVE-2022-30991
CVE-2022-30991 affects Acronis Cyber Protect 15 (Linux and Windows) before build 29240. The issue is HTML injection via the report name. Connected sources confirm the affected product/version and the vulnerability class; remediation guidance is to update to a version after build 29240. Exploitati...
