5272 matches found
Mozilla Thunderbird < 91.13.1
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.13.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-39 advisory. - If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having...
Mozilla Thunderbird < 91.13.1
The version of Thunderbird installed on the remote Windows host is prior to 91.13.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-39 advisory. - If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having the...
GHSA-3JH2-WMV7-M932 LibreNMS stored Cross-site Scripting via Schedule Maintenance `Title` parameter
LibreNMS versions 22.8.0 and prior allow attackers to execute arbitrary JavaScript code via the Schedule Maintenance Title parameter. A patch is available and anticipated to be part of version 22.9.0...
Smarty Cross-site Scripting vulnerability in pages that use smarty_function_mailto
In Smarty before 3.1.47 and 4.x before 4.2.1, libs/plugins/function.mailto.php allows cross-site scripting. A web page that uses smartyfunctionmailto, and that could be parameterized using GET or POST input parameters, could allow injection of JavaScript code by a user...
Security Bulletin: A cross-site scripting vulnerability occurs in IBM Business Automation Workflow and IBM Business Process Manager (BPM) (CVE-2019-4410)
Summary A cross-site scripting vulnerability was found in IBM Business Automation Workflow and IBM Business Process Manager. Vulnerability Details CVEID: CVE-2019-4410 DESCRIPTION: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed...
CVE-2022-40626
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...
CVE-2022-40626
An unauthenticated user can create a link with reflected Javascript code inside the backurl parameter and send it to other authenticated users in order to create a fake account with predefined login, password and role in Zabbix Frontend...
Input validation
insert HTML / js code inside input how to get to the vulnerable input : Workers worker nickname inject in this input the code...
Revive Adserver: Multiple cross-site scripting (XSS) vulnerabilities in Revive Adserver
Vulnerability description not provided...
CVE-2022-37731
ftcms 2.1 poster.PHP has a XSS vulnerability. The attacker inserts malicious JavaScript code into the web page, causing the user / administrator to trigger malicious code when accessing...
Cross site scripting
A stored cross-site scripting XSS vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fix...
CVE-2022-31792
A stored cross-site scripting XSS vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fix...
CVE-2022-2941 WP-UserOnline <= 2.88.0 - Authenticated (Admin+) Stored Cross-Site Scripting
The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fact that all fields in the "Naming Conventions" section do not properly sanitize user input, nor escape it on output. This makes it possible...
WatchGuard Firebox cross-site scripting vulnerability
WatchGuard Firebox is a US-based WatchGuard company that provides comprehensive network security services ranging from traditional IPS, GAV, website/application control and malicious software prevention. A security vulnerability exists in the WatchGuard Firebox and XTM appliances that originates...
UBUNTU-CVE-2022-39050
An attacker who is logged into OTRS as an admin user may manipulate customer URL field to store JavaScript code to be run later by any other agent when clicking the customer URL link. Then the stored JavaScript is executed in the context of OTRS. The same issue applies for the usage of external...
Fedora 36 : thunderbird (2022-8bf22a684b)
The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-8bf22a684b advisory. Update to 102.2.1 ; https://www.mozilla.org/en-US/security/advisories/mfsa2022-38/ Tenable has extracted the preceding description block directly from the...
Mozilla Thunderbird < 102.2.1
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 102.2.1. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-38 advisory. - If a Thunderbird user replied to a crafted HTML email containing a meta tag, with the meta tag having...
CVE-2022-36051 Broken Authorization in ZITADEL Actions
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...
CVE-2022-36051 Broken Authorization in ZITADEL Actions
ZITADEL combines the ease of Auth0 and the versatility of Keycloak.Actions, introduced in ZITADEL 1.42.0 on the API and 1.56.0 for Console, is a feature, where users with role.ORGOWNER are able to create Javascript Code, which is invoked by the system at certain points during the login. Actions,...
Authorization Bypass
github.com/zitadel/zitadel is vulnerable to authorization bypass. The user role with ORGOWNER can create javascript code through the usergrant.go and invoked by the system at certain points during the login, allowing an attacker to grant authorizations for projects that belong to other...