Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Gravity Master Custom Field For WP Job Manager plugin = 1.1 versions...

CVE-2023-37980

CVE-2023-37980 affects the Gravity Master Custom Field For WP Job Manager plugin (WordPress) up to version 1.1. It is an authenticated stored XSS vulnerability exploitable by an administrator (admin+) to inject script via the Custom Field for WP Job Manager. Root cause details in the sources indi...

WordPress Plugin Custom Field For WP Job Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Job Portal CMS 2.3.0.2 SQL Injection

==================================================================================================================================== | Title : Job Portal CMS V2.3.0.2 Sql Injection Vulnerability | | Author : indoushka | | Telegram : @indoushka | | Tested on : windows 10 Français V.Pro | | Vendor ...

PT-2023-15101 · Vocera · Vocera Voice Server +2

Name of the Vulnerable Software and Affected Versions: Vocera Report Server and Voice Server versions 5.x through 5.8 Description: An issue was discovered in the software, allowing Path Traversal in the Task Exec filename. The Vocera Report Console contains various jobs executed on the server at...

CVE-2023-3344

The CVE-2023-3344 entry concerns the WordPress plugin Auto Location for WP Job Manager via Google, prior to version 1.1. It stems from insufficient sanitisation/escaping of certain plugin settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins), including scenarios wh...

CVE-2023-3344 Auto Location for WP Job Manager via Google < 1.1 - Admin+ Cross Site Scripting

The Auto Location for WP Job Manager via Google WordPress plugin before 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup To test, you also need to have WP Job...

Custom Field For WP Job Manager < 1.2 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC To test, you also need to have WP...

WordPress Plugin Auto Location for WP Job Manager via Google 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2023-24343 · WordPress · Auto Location For Wp Job Manager Via Google

Name of the Vulnerable Software and Affected Versions: Auto Location for WP Job Manager via Google WordPress plugin versions prior to 1.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is...

Denial Of Service (DoS)

gitlab is vulnerable to Denial of Service DoS attacks. An attacker might use a forged CI job artifact zip file in a project that employs dynamic child pipelines to cause a sidekiq task to use a large amount of RAM. This may result in a Denial of Service on GitLab instances where Sidekiq is...

WordPress Go Fetch Jobs (for WP Job Manager) Plugin <= 1.8.2.2 is vulnerable to Cross Site Scripting (XSS)

Software Go Fetch Jobs for WP Job Manager Type Plugin Vulnerable versions = 1.8.2.2 Fixed in 1.8.4.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 4f78961ea025 Credits Rafie Muhammad...

CVE-2023-37272

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

CVE-2023-37272

Summary (CVE-2023-37272) : The JOC Cockpit component of JobScheduler (JS7) is affected by a cross-site scripting (XSS) vulnerability that arises when users upload files containing user-generated documents and specify filenames crafted to inject code executed in the browser. The issue is present i...

CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13

JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....

WordPress Custom Field For WP Job Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Custom Field For WP Job Manager Type Plugin Vulnerable versions = 1.1 Fixed in 1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-37980 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 73b4e2c1fddd Credits Rio Darmawa...

Jenkins External Monitor Job Type Plugin XML external entity vulnerability

Jenkins External Monitor Job Type Plugin 206.v9a94ff0b4a10 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extracti...

GHSA-G4C3-4F3V-84X8 Jenkins External Monitor Job Type Plugin XML external entity vulnerability

Jenkins External Monitor Job Type Plugin 206.v9a94ff0b4a10 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extracti...