CVE-2022-3073

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser...

Input validation

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser...

CVE-2022-3073 Quaonos Schema ST4 example templates prone to XSS

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser...

CVE-2022-3073 Quaonos Schema ST4 example templates prone to XSS

Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser...

CVE-2022-3073

The CVE-2022-3073 entry concerns Quanos SCHEMA ST4 example web templates (Bootstrap 2019 v2 through 2022 SP1 v1). Affected component is the *-schema.js script, whose JavaScript injection vulnerability can allow a remote attacker to hijack existing sessions or run scripts in a user’s browser. Docu...

PT-2022-20267 · Unknown · Quanos Schema St4

Name of the Vulnerable Software and Affected Versions: Quanos SCHEMA ST4 versions Bootstrap 2019 v2 through 2022 SP1 v1 Description: The issue allows a remote attacker to perform JavaScript injection, potentially hijacking existing sessions to access other web services in the same environment or...

Bootstrap 跨站脚本漏洞

Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript. A cross-site scripting vulnerability exists in Bootstrap 2019 v2, 2021 v1, 2022 v1, 2022 SP1 v1, and prior versions, which stems from the Quanos "SCHEMA ST4" sample web template being vulnerable to...

GHSA-Q7JC-V6F2-Q9JR Duplicate Advisory: Resque Scheduler Reflected XSS In Delayed Jobs View

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9hmq-fm33-x4xx. This link is maintained to preserve external references. Original Description Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting XSS. A remote attacker could inject javascript...

Cross-Site Scripting (XSS)

claviska/jquery-minicolors is vulnerable to cross-site scripting. The vulnerability exists because of the lack of sanitization in the name attribute in jquery.minicolors.min.js, allowing an attacker to inject and execute malicious JavaScript...

CVE-2022-44303

Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting XSS. A remote attacker could inject javascript code to the "schedulejob" or "args" parameter in /resque/delayed/jobs/schedulejob?args=argsid to execute javascript at client side...

Resque Scheduler 跨站脚本漏洞

Resque Scheduler is Resque open source a lightweight job scheduling system built on Resque . Resque Scheduler version 1.27.4 security vulnerability , the vulnerability stems from the vulnerability to cross-site scripting XSS attacks , a remote attacker can inject javascript code into...

CVE-2022-46905

Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS...

Cross-site Scripting (XSS)

yiisoft/yii2-gii is vulnerable to cross-site scripting. The vulnerability exists in the rules function of Generator.php due to a lack of proper validation rules for enableI18N and messageCategory which allows an attacker to inject and execute malicious JavaScript...

Cross-site Scripting (XSS)

ms-mcms is vulnerable to cross-site scripting. The vulnerability exists due to the manipulation of contenttitle argument in search.do which allows an attacker to inject and execute malicious JavaScript...

Planet Enterprises Planet eStream 跨站脚本漏洞

Planet Enterprises Planet eStream is a very simple and secure tool from Planet Enterprises, Inc. It can make video more accessible to students and staff at all levels of education. A cross-site scripting vulnerability exists in Planet Enterprises Planet eStream versions prior to 6.72.10.07, which...

Lansweeper 跨站脚本漏洞

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A security vulnerability exists in Lansweeper version 10.1.1.0. An attacker can exploit the vulnerability to inject arbitrary Javascript code...

Lansweeper 跨站脚本漏洞

Lansweeper is an IT asset management system from Lansweeper Belgium. The system includes features such as IT asset discovery and network settings scanning. A security vulnerability exists in Lansweeper version 10.1.1.0, which stems from the presence of stored cross-site scripting, where a special...

CVE-2022-36433

The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading to XSS attacks against admin panel users via posts/preview or posts/save...

Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting.The vulnerability exists in the sanitise function of HTMLEditorSanitiser.php because of using white space characters in HTMLEditor which allows an attacker to inject and execute malicious JavaScript...

Cross-site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting. The vulnerability exists in the sanitise function of HTMLEditorSanitiser.php because of uppercase characters in HTMLEditor which allows an attacker to inject and execute malicious JavaScript...