CVE-2022-26384

If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91....

UBUNTU-CVE-2022-26384

If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript execution in violation of the sandbox. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91....

Mozilla Firefox ESR < 91.7

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-11 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,...

PT-2022-1912

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 98 Firefox ESR versions prior to 91.7 Thunderbird versions prior to 91.7 Description The issue is related to a logical error in handling iframes. If an attacker could control the contents of an iframe sandboxed with...

CVE-2021-44748: Improper Neutralization of Input During Web Page Generation

A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the browser. User interaction is required...

PT-2022-12219

Name of the Vulnerable Software and Affected Versions F-Secure SAFE browser affected versions not specified Description A vulnerability was discovered in the F-Secure SAFE browser where it automatically loads images, allowing an attacker to remotely execute JavaScript and trigger universal...

CVE-2022-23710

A cross-site-scripting XSS vulnerability was discovered in the Data Preview Pane previously known as Index Pattern Preview Pane which could allow arbitrary JavaScript to be executed in a victim’s browser...

CVE-2022-23710

A cross-site-scripting XSS vulnerability was discovered in the Data Preview Pane previously known as Index Pattern Preview Pane which could allow arbitrary JavaScript to be executed in a victim’s browser...

PT-2022-16221

Name of the Vulnerable Software and Affected Versions Kibana versions affected versions not specified Description A cross-site-scripting XSS vulnerability was discovered in the Data Preview Pane, which could allow arbitrary JavaScript to be executed in a victim's browser. Recommendations At the...

CVE-2022-23656: Improper Neutralization of Input During Web Page Generation

Zulip is an open source team chat app. The main development branch of Zulip Server from June 2021 and later is vulnerable to a cross-site scripting vulnerability on the recent topics page. An attacker could maliciously craft a full name for their account and send messages to a topic with several...

MaxSite CMS 跨站脚本漏洞

MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project.Maxsite CMS has a cross-site scripting vulnerability , the vulnerability stems from the lack of parameters in the management file f the user-supplied data and output data validation filter , an attacker...

WordPress plugin Testimonial 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. A cross-site scripting vulnerability exists in versions of the WordPress Testimonial Plugin prior to 1.4.7. The vulnerability stems from the failure of the Testimonial plugin to clean and escape...

WordPress 跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress EditableTable plugin versions prior to 0.1.4 have a cross-site scripting vulnerability that stems from the...

Ice Hrm 跨站脚本漏洞

Ice Hrm is a human resource management system. Ice Hrm version 30.0.0.OS is vulnerable to a cross-site scripting vulnerability that stems from a lack of checksum filtering of user-supplied data and output data in the key and fm parameters in the component login.php. An attacker could exploit this...

CVE-2022-24948

A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users...

CVE-2022-24948

A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users...

CVE-2022-24948: Improper Neutralization of Input During Web Page Generation

A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki, related to the user preferences screen, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users...

BloofoxCms 跨站脚本漏洞

BloofoxCms is a Php-based text content management system from alexlang24 personal developer. bloofoxCMS suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the file and type parameters in index.php. An attacker...

CVE-2022-24708 Stored XSS vulnerability in anuko/timetracker

Anuko Time Tracker is an open source, web-based time tracking application written in PHP. ttUser.class.php in Time Tracker versions prior to 1.20.0.5646 was not escaping primary group name for display. Because of that, it was possible for a logged in user to modify primary group name with element...

CVE-2021-46681

A XSS vulnerability exist in Pandora FMS version 756 and below, that allows an attacker to perform javascript code executions via module massive operation name field...