GHSA-VP62-M958-QJ8C Gravitee API Management contains Path Traversal

This CVE addresses the partial fix for CVE-2019-25075 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary...

Gravitee API Management contains Path Traversal

This CVE addresses the partial fix for CVE-2019-25075 Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A cross-site scripting vulnerability exists in Discourse discourse-mermaid-theme-component version 1.0.0, which can be exploited by an attacker to inject arbitrary HT...

CVE-2022-38723

Gravitee API Management before 3.15.13 allows path traversal through HTML injection...

Path traversal

Gravitee API Management before 3.15.13 allows path traversal through HTML injection...

Security Bulletin: B2B API of IBM Sterling B2B Integrator vulnerable to multiple issues due to CKEditor

Summary IBM Sterling B2B Integrator has addressed the CKEditor security vulnerabilities in B2B API. Vulnerability Details CVEID:CVE-2021-32808 DESCRIPTION: CKEditor is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the clipboard Widget plugin if used...

CVE-2022-38723

Gravitee API Management before 3.15.13 allows path traversal through HTML injection...

CVE-2022-38723

CVE-2022-38723 affects Gravitee API Management prior to version 3.15.13, where an HTML-injection flaw enables path traversal. Multiple connected sources confirm the vulnerability exists in Gravitee API Management before 3.15.13 and describe the underlying issue as HTML injection that allows path ...

PT-2023-13640 · Unknown · Gravitee Api Management

Name of the Vulnerable Software and Affected Versions: Gravitee API Management versions prior to 3.15.13 Description: The issue allows path traversal through HTML injection, potentially enabling anonymous users to read arbitrary files. This is achieved by combining HTML injection with path...

CVE-2022-38723

Gravitee API Management before 3.15.13 allows path traversal through HTML injection...

CVE-2022-38723

Gravitee API Management before 3.15.13 allows path traversal through HTML injection...

Gravitee API Management 路径遍历漏洞

Gravitee API Management is an open source Gravitee API management tool. A path traversal vulnerability exists in Gravitee API Management versions prior to 3.15.13, which stems from a vulnerability that allows an attacker to implement path traversal via HTML injection...

CVE-2022-4142

The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufggalleryfilters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page,...

CVE-2022-4142

The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufggalleryfilters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page,...

CVE-2022-4142

The CVE-2022-4142 entry concerns the WordPress Filter Gallery Plugin (before 0.1.6). Affected component: the ufg_gallery_filters AJAX action that does not properly escape user-supplied filters before rendering on the settings page. Root cause: insufficient escaping enables a high-privileged user ...

PT-2023-13983 · WordPress · Wordpress Filter Gallery Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Filter Gallery Plugin version 0.1.5 and earlier Description: The WordPress Filter Gallery Plugin does not properly escape the filters passed in the ufg gallery filters ajax action before outputting them on the page. This allows a hi...

Authenticated HTMLi via theme parameter on /lib/ajax.php

Description The theme parameter is vulnerable to HTMLi on /lib/ajax.php endpoint Proof of Concept - go to https://v2.demo.froxlor.org - Login with a user - Go to https://v2.demo.froxlor.org/lib/ajax.php?action=newsfeed&theme=%3C/br%3E%3Ch1%3EHTMLi%20by%20leorac%3C/h1%3E%3Cbr%3E - You'll see the...

CVE-2022-38210 HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)

There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...

CVE-2022-38210

CVE-2022-38210 describes a reflected HTML-injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below, affecting the accountswitcher-callback.html path. An unauthenticated remote attacker could craft a link that, when clicked, renders arbitrary HTML in the victim’s browser. Affect...

CVE-2022-38210 HTML injection in accountswitcher-callback.html (10.9.1, 10.8.1 and 10.7.1 only)

There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...