607 matches found
PT-2024-24608
Name of the Vulnerable Software and Affected Versions Ankitects Anki version 24.04 Description A reflected XSS issue exists in the handling of invalid paths in the Flask server. This can be triggered by a specially crafted flashcard, leading to JavaScript code execution and potentially resulting ...
CVE-2024-32484: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...
PT-2024-5685
Name of the Vulnerable Software and Affected Versions Netcat CMS affected versions not specified Description The issue exists due to inadequate protection of the web page structure in the logging module of the Netcat CMS system. This allows a remote attacker to execute arbitrary JavaScript code i...
IBM InfoSphere Information Server Cross-Site Scripting Vulnerability (CNVD-2024-30630)
IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server that stems from...
SUSE-FU-2024:2078-1 Feature update for rabbitmq-server313, erlang26, elixir115
This update for rabbitmq-server313, erlang26, elixir115 fixes the following issues: rabbitmq-server was implemented with a parallel versioned RPM package at version 3.13.1 jscPED-8414: - Security issues fixed: CVE-2021-22116: Fixed improper input validation that may lead to Denial of Sercice DoS...
CVE-2024-37888 The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality
The Open Link is a CKEditor plugin, extending context menu with a possibility to open link in a new tab. The vulnerability allowed to execute JavaScript code by abusing link href attribute. It affects all users using the Open Link plugin at version 1.0.5...
CVE-2024-36236 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting XSS vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user...
CVE-2024-26090 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting XSS vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user...
CVE-2024-26053: Improper Neutralization of Input During Web Page Generation
Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting XSS vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user...
PT-2024-4440
Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.20 and earlier Description The issue is related to insufficient protection of the web page structure, allowing an attacker to execute arbitrary JavaScript code in the context of the victim's browser sessio...
PT-2024-4442
Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.20 and earlier Description The issue is related to insufficient protection of the web page structure, which could allow an attacker to execute arbitrary JavaScript code in the context of the victim's brows...
PT-2024-27350
Name of the Vulnerable Software and Affected Versions ghtml versions prior to 2.0.0 Description The issue allows for the introduction of user-controlled JavaScript code, potentially triggering a Cross-Site Scripting XSS vulnerability in certain cases. Developers should be cautious and take...
PT-2024-3989
Name of the Vulnerable Software and Affected Versions Pug versions 3.0.2 and earlier Description The issue is related to the incorrect management of code generation in the Pug template engine, specifically in the compileClient, compileFileClient, and compileClientWithDependenciesTracked functions...
CVE-2024-31974: Improper Control of Generation of Code
The com.solarized.firedown aka Solarized FireDown Browser & Downloader application 1.0.76 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. com.solarized.firedown.IntentActivity uses a WebView component to display web content and doesn't adequately...
static-web-server vulnerable to stored Cross-site Scripting in directory listings via file names
Summary If directory listings are enabled for a directory that an untrusted user has upload privileges for, a malicious file name like .txt will allow JavaScript code execution in the context of the web server’s domain. Details SWS generally does not perform escaping of HTML entities on any value...
MediaWiki cross-site scripting vulnerability (CNVD-2024-12712)
MediaWiki is an open source Wiki system based on PHP+MySQL environment. MediaWiki cross-site scripting attack vulnerability , the reason for this vulnerability is because the WatchAnalytics extension has a vulnerability , an attacker can use this vulnerability through the Special:PageStatistics...
CVE-2024-24816
CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A cross-site scripting vulnerability vulnerability has been discovered in versions prior to 4.24.0-lts in samples that use the "preview" feature. All integrators that use these samples in the production code can be affected. Th...
CVE-2024-22418: Improper Neutralization of Input During Web Page Generation
Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename suc...
CVE-2023-43481: Improper Control of Generation of Code
An issue in Shenzhen TCL Browser TV Web BrowseHere aka com.tcl.browser 6.65.022dab24cc6231221gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component...