Ascensio System ONLYOFFICE Resource Management Error Vulnerability

Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. A resource management error vulnerability exists in Ascensio System ONLYOFFICE DocumentServer versions 4.0.3 through 7.3.2, which stems from the presence of a post-release reuse vulnerability. An attacker could exploit...

CVE-2023-38138

A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluate...

PT-2023-26319 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: A reflected cross-site scripting XSS issue exists in an undisclosed page of the BIG-IP Configuration utility. This allows an attacker to run JavaScript in the context of the currently...

CVE-2023-38423: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-38138: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluate...

CVE-2023-38308

An issue was discovered in Webmin 2.021. A Cross-Site Scripting XSS vulnerability was discovered in the HTTP Tunnel functionality when handling third-party domain URLs. By providing a crafted URL from a third-party domain, an attacker can inject malicious code. leading to the execution of arbitra...

CVE-2023-38309

An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's...

CVE-2023-38309: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Webmin 2.021. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the package search functionality. The vulnerability allows an attacker to inject a malicious payload in the "Search for Package" field, which gets reflected back in the application's...

Webmin cross-site scripting vulnerabilities

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community. A security vulnerability exists in Webmin version 2.021, which stems from a cross-site scripting XSS vulnerability discovered in the HTTP tunneling feature when handling third-party...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to stored Cross-site Scripting XSS. The vulnerability exists registerResourcePublicRoutes function at resource.go because the default-src in CSP is not properly configured which allows an attacker to bypass the CSP, inject and execute arbitrary javascript...

Esri Portal For ArcGIS Cross-Site Scripting Vulnerability

Esri Portal For ArcGIS is an Esri component that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal For ArcGIS that can be exploited by an attacker to execute arbitrary...

PT-2023-20343

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Enterprise Sites versions 10.8.1 through 10.9 Description The issue is a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could potentially...

Esri Portal For ArcGIS Cross-site Scripting Vulnerability

Esri Portal For ArcGIS is an Esri component that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A cross-site scripting vulnerability exists in Esri Portal For ArcGIS that can be exploited by an attacker to execute arbitrary...

@3kles/3kles-coremongodb (>=1.2.3, <=1.3.1), @3kles/storagebox-common (1.0.3) +303 more potentially affected by CVE-2023-3696 via mongoose (>=6.0.1, <=6.11.2)

mongoose NPM version =6.0.1, =1.2.3, =2.0.1, =0.0.1-alpha.89, =0.0.1-alpha.89, =0.0.3, =1.0.5, =3.9.0, =1.0.9, =1.0.0-beta1, =1.4.5, =1.1.80, =0.0.1, =0.0.1, =0.1.9 and more Source cves: CVE-2023-3696 Source advisory: GHSA-9M93-W8W6-76HH...

CVE-2023-2507

CVE-2023-2507 affects CleverTap Cordova Plugin (version 2.6.2). The vulnerability arises from improper validation of data from deeplinks, allowing a remote attacker to execute JavaScript in apps opened via a crafted deeplink (XSS/remote code execution-like behavior described in sources). A patch ...

CVE-2023-30791

Plane version 0.7.1-dev is affected: an attacker can change a user’s avatar, enabling upload of files with an HTML extension that are interpreted as HTML and JavaScript. This is described across multiple sources as an insecure avatar-upload path leading to HTML/JS content. Remediation guidance in...

Plane code issue vulnerabilities

Plane is an open source, self-hosted project planning tool from Plane Open Source. A security vulnerability exists in Plane version 0.7.1-dev, which stems from a vulnerability that allows an attacker to change the avatar of their profile, thereby allowing the upload of files with HTML extensions...

PT-2023-19912

Name of the Vulnerable Software and Affected Versions CleverTap Cordova Plugin version 2.6.2 Description The CleverTap Cordova Plugin does not correctly validate the data coming from deeplinks before using them, allowing a remote attacker to execute JavaScript code in any application that is open...

CVE-2023-2507: Improper Neutralization of Input During Web Page Generation

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them...

PT-2023-23658 · Apache +1 · Apache Jena +1

Name of the Vulnerable Software and Affected Versions: Apache Jena versions 3.7.0 through 4.8.0 Description: The issue is related to insufficient restrictions of called script functions in Apache Jena, allowing a remote user to execute javascript via a SPARQL query. Recommendations: For Apache Je...