com.cantaa:cantaa-commons (1.1), com.cooldatasoft:wicket-menu (>=6.16.0.0, <=6.16.0.4) +243 more potentially affected by CVE-2021-23937 via org.apache.wicket:wicket-core (6.16.0)

org.apache.wicket:wicket-core MAVEN version 6.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.wicket:wicket-core and may be impacted: - com.cantaa:cantaa-commons 1.1 - com.cooldatasoft:wicket-menu =6.16.0.0, =6.16.0.0, =1.0.0, =0.9.4,...

GHSA-Q9XG-H756-8689 jquery-plugin-query-object contains prototype pollution vulnerability

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype...

jquery-plugin-query-object contains prototype pollution vulnerability

Improperly Controlled Modification of Object Prototype Attributes 'Prototype Pollution' in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype...

MediaWiki Cross-site Scripting (XSS) vulnerability

In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, XSS related to jQuery can occur. The attacker creates a message with javascript:payload xss and turns it into a jQuery object with mw.message.parse. The expected result is that the jQuery object does not contain an tag or it does...

GHSA-4VR7-M8P8-434H MediaWiki Cross-site Scripting (XSS) vulnerability

In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, XSS related to jQuery can occur. The attacker creates a message with javascript:payload xss and turns it into a jQuery object with mw.message.parse. The expected result is that the jQuery object does not contain an tag or it does...

SUSE-SU-2022:1729-1 Security update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud

This update for ardana-barbican, grafana, openstack-barbican, openstack-cinder, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-ironic, openstack-keystone, openstack-neutron-gbp, python-lxml, release-notes-suse-openstack-cloud fixes the following issues: Security fixes included on...

jQuery File Upload Plugin Unrestricted file upload vulnerability

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...

GHSA-WXG6-F773-G2F7 jQuery File Upload Plugin Unrestricted file upload vulnerability

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...

Drupal cross site scripting vulnerability

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...

GHSA-5VPR-V24W-MMJJ Drupal cross site scripting vulnerability

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...

ca.stellardrift.guice-backport.extensions:guice-struts2 (5.0.1), com.google.inject.extensions:guice-struts2 (>=3.0-rc2, <=5.0.1) +63 more potentially affected by CVE-2012-0838 via org.apache.struts.xwork:xwork-core (>=2.2.1, <=2.2.3)

org.apache.struts.xwork:xwork-core MAVEN version =2.2.1, =3.0-rc2, =2.4.0, =2.4.0, =3.0.0, =3.0.0, =2.4.0, =2.4.0, =2.4.0, =3.0.0, =2.0.0, =0.9.2, =0.9.0, =0.9.1 - io.forestframework:guice-struts2 5.0.1.1 and more Source cves: CVE-2012-0838 Source advisory: OSV:GHSA-MWRX-HX6X-3HHV...

bones (>=1.1.0, <=2.0.0), clustergrammer (>=1.4.8, <=1.12.0) +14 more potentially affected by CVE-2011-4969 via jquery (>=1.5.1, <=1.6.2)

jquery NPM version =1.5.1, =1.1.0, =1.4.8, =0.0.2, =1.0.0, =0.1.61, =0.0.9, =0.0.0-rc1, =0.5.0, =0.6.2 and more Source cves: CVE-2011-4969 Source advisory: OSV:GHSA-579V-MP3V-RRW5...

bones (>=1.1.0, <=2.0.0), clustergrammer (>=1.4.8, <=1.12.0) +14 more potentially affected by CVE-2011-4969 via jquery (>=1.5.1, <=1.6.2)

jquery NPM version =1.5.1, =1.1.0, =1.4.8, =0.0.2, =1.0.0, =0.1.61, =0.0.9, =0.0.0-rc1, =0.5.0, =0.6.2 and more Source cves: CVE-2011-4969 Source advisory: GHSA-579V-MP3V-RRW5...

jQuery vulnerable to Cross-Site Scripting (XSS)

Cross-site scripting XSS vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag...

GHSA-579V-MP3V-RRW5 jQuery vulnerable to Cross-Site Scripting (XSS)

Cross-site scripting XSS vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag...

GHSA-PJV3-RH6V-2PJ8 Cross-site Scripting in wicket-jquery-ui

In wicket-jquery-ui = 6.29.0, = 7.10.1, = 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display...

Cross-site Scripting in wicket-jquery-ui

In wicket-jquery-ui = 6.29.0, = 7.10.1, = 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display...

GHSA-PWPC-HQQ2-HX2X Cross-site Scripting in wicket-jquery-ui

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...

Cross-site Scripting in wicket-jquery-ui

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor...

com.googlecode.wicket-jquery-ui:wicket-jquery-ui (>=7.0.0-m3, <=7.0.0-m4), com.googlecode.wicket-jquery-ui:wicket-jquery-ui-calendar (>=7.0.0-m3, <=7.0.0-m4) +284 more potentially affected by CVE-2014-7808 via org.apache.wicket:wicket-core (>=7.0.0-m1, <=7.0.0-m4)

org.apache.wicket:wicket-core MAVEN version =7.0.0-m1, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m3, =7.0.0-m4 - com.googlecode.wicke...