3977 matches found
Sysaid Technologies Sysaid 跨站脚本漏洞
Sysaid Technologies SysAid is a suite of IT service management solutions from Sysaid Technologies, Israel. Sysaid Technologies Sysaid version 14.2.0 suffers from a cross-site scripting vulnerability that originates from a lack of filtering and escaping of the parameter helpPageName used by the pa...
CVE-2022-23165: Improper Neutralization of Input During Web Page Generation
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...
Cross site scripting
A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub'...
Black Duck Hub 跨站脚本漏洞
SYNOPSYS Black Duck Hub Open Hub is a web-based community platform from SYNOPSYS, Inc. It provides a suite of Web services. Black Duck Hub suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of user input by the MadCap Flare framework embedded in the he...
CVE-2022-23165
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...
CVE-2021-3898
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...
CVE-2021-3898
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...
CVE-2021-3898
The CVE-2021-3898 issue affects Motorola Ready For and Motorola Device Help Android apps prior to 2021-04-08, caused by improper verification of server certificates. The root cause enables an attacker to access the communication channel. Reported impacts include potential confidentiality exposure...
CVE-2021-3898: Improper Certificate Validation
Versions of Motorola Ready For and Motorola Device Help Android applications prior to 2021-04-08 do not properly verify the server certificate which could lead to the communication channel being accessible by an attacker...
7-Zip 16 DLL Hijacking
Microsoft Windows Environment Variable Expansion Issue Leads To Remote DLL Hijack Attack vector: 7-ZIP v.16 7-ZIP v.16 and possibly other softwares that utilizes the HTML Help System are prone to a remote DLL hijacking issue which leads to arbitrary code execution. PoC attached. because the OS...
CVE-2022-1019
Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file...
Vulnerability found in 7zip for Windows
A vulnerability has been found in 7zip for Windows. This vulnerability allows a malicious person to obtain elevated privileges obtain and execute commands with these privileges. This can be accomplished by moving a file with a .7z extension to "Contents" within the "Help" menu. Within the 7z.dll ...
CVE-2022-1019: URL Redirection to Untrusted Site
Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file...
CVE-2022-26594
Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...
CVE-2022-26594
Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...
7-Zip 缓冲区错误漏洞
7-Zip is a compression software. A buffer error vulnerability exists in 7-Zip 21.07 that allows privilege escalation and command execution when a file with the extension .7z is dragged into the HelpContents area. This is caused by a 7z.dll configuration error and heap overflow. The command runs i...
CVE-2022-26594: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...
CVE-2021-43460
An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService service executable path...
