CVE-2024-36110 Cross-site scripting in ansibleguy-webui

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 0.0.21.post2 on pypi...

CVE-2024-36110 Cross-site scripting in ansibleguy-webui

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 0.0.21.post2 on pypi...

Cross Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross Site Scripting XSS. The vulnerability is due to inadequate sanitisation of the rewriteHashlinks option in SSViewer, allowing an attacker to inject HTML through the querystring...

Cross Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper handling of error messages generated for the CMS login page, where the URL of the requested page is interpolated without proper escaping, allowing for arbitrary HTML injection...

MantisBT < 2.26.2 Multiple Vulnerabilities

According to its version number, the MantisBT application hosted on the remote web server is prior to 2.26.2. It is, therefore, affected by the following vulnerabilities : - Insufficient access control in the registration and password reset process allows an attacker to reset another user's...

GHSA-MPQJ-F4V3-334H Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

A cross-site scripting vulnerability in VersionedRequestFilter has been found. If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested...

Silverstripe Cross-site scripting vulnerability in VersionedRequestFilter

A cross-site scripting vulnerability in VersionedRequestFilter has been found. If an incoming user request should not be able to access the requested stage, an error message is created for display on the CMS login page that they are redirected to. In this error message, the URL of the requested...

GHSA-34Q6-XQXH-GQ39 Silverstripe XSS In rewritten hash links

A high level XSS vulnerability has been discovered in the SilverStripe framework which causes links containing hash anchors E.g. href="anchor" to be rewritten in an unsafe way. The rewriteHashlinks option on SSViewer will rewrite these to contain the current url, although without adequate escapin...

HTML Injection

passbolt/passboltapi is vulnerable to HTML injection. The vulnerability is due to improper input sanitization, allowing an attacker to inject HTML code in emails...

PT-2024-40365 · Cms · Cms

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, so: CMS affected versions not specified Description: The issue is due to a lack of parameter sanitisation, allowing a carefully crafted URL to inject arbitrary HTML into the CMS Edit page. An attack...

PT-2024-40041 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: SilverStripe framework affected versions not specified Description: A high-level XSS issue has been found in the SilverStripe framework. It affects how links with hash anchors are rewritten. The rewriteHashlinks option in SSViewer rewrites...

PT-2024-40378 · Unknown · Versionedrequestfilter

Name of the Vulnerable Software and Affected Versions: VersionedRequestFilter affected versions not specified Description: A cross-site scripting issue has been discovered. When a user request is denied access to the requested stage, an error message is generated for display on the CMS login page...

PT-2024-40189 · Silverstripe · Silverstripe Gridfield

Name of the Vulnerable Software and Affected Versions: Silverstripe GridField affected versions not specified Description: A cross-site scripting issue has been found in the print view of GridField. This can be exploited if a user with CMS access posts malicious or unescaped HTML into any field o...

GHSA-V86M-J5F7-CCWH Passbolt Api E-mail HTML injection

Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description. Passbolt does not escape the user’s input properly, resulting in the...

Passbolt Api E-mail HTML injection

Passbolt sends e-mail to users to warn them about different type of events such as the creation, modification or deletion of a password. Those e-mails may contain user-specified input, such as a password’s title or description. Passbolt does not escape the user’s input properly, resulting in the...

Elementor Header & Footer Builder < 1.6.27 - Authenticated (Author+) HTML Injection

Description The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to...

GitLab 9.5 < 13.11.6 / 13.12 < 13.12.6 / 14.0 < 14.0.2 (CVE-2021-22232)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE CVE-2021-22232 Note that Nessus has not tested for this issue but has instead relied only ...

CVE-2024-2619

The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject...

CVE-2024-2619

The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject...

CVE-2024-2619

CVE-2024-2619 : Elementor Header & Footer Builder for WordPress is vulnerable to HTML injection due to insufficient input sanitization and output escaping. Affected versions are up to and including 1.6.26. Exploitation requires authentication with author-level permissions or higher, enabling an a...