Design/Logic Flaw

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...

CVE-2022-29816

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...

CVE-2022-29816

JetBrains IntelliJ IDEA prior to 2022.1 is affected by HTML injection into IDE messages. The issue arises from injecting HTML into the IDE’s message rendering, enabling potential HTML-based content exposure. Remediation is to upgrade to IntelliJ IDEA 2022.1 or later, where the fix is applied. Off...

CVE-2022-29816

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...

CVE-2022-28101: Improper Neutralization of Input During Web Page Generation

Turtlapp Turtle Note v0.7.2.6 does not filter the tag during markdown parsing, allowing attackers to execute HTML injection...

PT-2022-19849 · Jetbrains · Intellij Idea

Name of the Vulnerable Software and Affected Versions: JetBrains IntelliJ IDEA versions prior to 2022.1 Description: The issue allows HTML injection into IDE messages. Recommendations: For versions prior to 2022.1, update to version 2022.1 or later to resolve the issue...

PT-2022-18809

Name of the Vulnerable Software and Affected Versions Turtlapp Turtle Note version 0.7.2.6 Description The issue allows attackers to execute HTML injection due to the lack of filtering of the tag during markdown parsing. Recommendations For version 0.7.2.6, as a temporary workaround, consider...

CVE-2022-29816: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible...

CVE-2022-28102: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected at /edit-db.php...

PT-2022-2403

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 101.0.4951.41 Description The issue is related to insufficient data validation in Blink Editing, which can be exploited by a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. This coul...

CVE-2022-26597

This CVE-2022-26597 affects Liferay Portal 7.3.0–7.4.0 (and Liferay DXP 7.3 before Service Pack 3) via the Layout module’s Open Graph integration. The root cause is a cross-site scripting (XSS) vulnerability that lets remote attackers inject arbitrary web script or HTML through the site name. The...

CVE-2022-27428

CVE-2022-27428 is a stored XSS in GalleryCMS v2.0, exploited via the album_name parameter in /index.php/album/add. The vulnerability arises from lack of input validation/escaping, allowing arbitrary web scripts when a crafted payload is submitted. Documents consistently describe the impact as cli...

CVE-2022-2511

Cross-site Scripting XSS vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the title parameter of the call URL...

HTML Injection in Subscan view

Description HTML code is executed in the Subscan feature Proof of Concept 1. Add a scan engine: HTMLInjection 2. Go to "subdomains" for a target and add a Subscan using the scan engine. 3. Initiate a Subscan 4. View the subscan...

Lansweeper Cross-Site Scripting Vulnerability

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery, network settings scanning, etc. A cross-site scripting vulnerability exists in Lansweeper 9.1.20.2, which stems from a failure to adequately clean user-supplied data in...

CVE-2022-24864

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

CVE-2022-24864

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to "/presale/join". User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website

Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...

CVE-2022-24799

wire-webapp is the web application interface for the wire messaging service. Insufficient escaping in markdown “code highlighting” in the wire-webapp resulted in the possibility of injecting and executing arbitrary HTML code and thus also JavaScript. If a user receives and views such a malicious...

CVE-2022-24799

CVE-2022-24799 describes a cross-site scripting vulnerability in Wire Webapp caused by insufficient escaping of markdown code highlighting, allowing execution of arbitrary HTML/JavaScript in the victim’s browser. Affected: wire-webapp and connected Wire desktop clients. Impact per description: at...