Sourcecodester Workout Journal App 跨站脚本漏洞

Workout Journal App is workout journal application. A security vulnerability exists in version 1.0 of the Sourcecodester Workout Journal App that stems from a cross-site scripting XSS vulnerability in the parameters firstname and lastname in the file /add-user.php...

PT-2024-20255 · Sourcecodester · Sourcecodester Workout Journal App

Name of the Vulnerable Software and Affected Versions: Sourcecodester Workout Journal App version 1.0 Description: The issue allows attackers to run arbitrary code via parameters firstname and lastname in the "/add-user.php" API endpoint. This enables attackers to execute arbitrary code,...

CVE-2024-24050

Sourcecodester Workout Journal App 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "/add-user.php" endpoint, where the application fails to properly sanitize user-supplied input for the firstname and lastname parameters. An attacker can inject malici...

biotechnologia-journal.org Cross Site Scripting vulnerability OBB-3868322

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

BIT-REDMINE-2021-30163

Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers to discover the names of private projects if issue-journal details exist that have changes to projectid values...

BIT-ODOO-2021-44461

Cross-site scripting XSS issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control the contents of accounting journal entries to inject arbitrary web script in the browser of a victim...

CVE-2024-24511

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component...

CVE-2024-25436

A cross-site scripting XSS vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Input subject field under the Add Discussion function...

CVE-2024-24512

Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component...

PT-2024-20430 · Public Knowledge · Pkp Ojs

Name of the Vulnerable Software and Affected Versions: PKP OJS version 3.4 Description: The issue allows an attacker to execute arbitrary code via the Input Title component. This is a Cross Site Scripting vulnerability. Recommendations: For PKP OJS version 3.4, consider disabling the Input Title...

PKP OPEN JOURNAL SYSTEMS Cross-Site Scripting Vulnerability

PKP OPEN JOURNAL SYSTEMS PKP OJS is an end-to-end scholarly publishing platform from PKP Inc. A cross-site scripting vulnerability exists in PKP OPEN JOURNAL SYSTEMS version v3.3, which originates from a vulnerability that allows attackers to execute arbitrary web script or HTML via the Input...

PKP OPEN JOURNAL SYSTEMS Cross-Site Scripting Vulnerability

PKP OPEN JOURNAL SYSTEMS PKP OJS is an end-to-end scholarly publishing platform from PKP Inc. A cross-site scripting vulnerability exists in PKP OPEN JOURNAL SYSTEMS v3.4 that originates from allowing an attacker to execute arbitrary code via the input subtitle component...

Pkp Ojs Cross Site Scripting Vulnerability

affinitybridge Pkp Ojs is an open source journal publication management software system from affinitybridge. A cross-site scripting vulnerability exists in Pkp Ojs version v3.3, which originates from a vulnerability that allows an attacker to execute arbitrary web script or HTML via the Input...

PKP OPEN JOURNAL SYSTEMS Cross-Site Scripting Vulnerability

PKP OPEN JOURNAL SYSTEMS PKP OJS is an end-to-end scholarly publishing platform from PKP Inc. A cross-site scripting vulnerability exists in PKP OPEN JOURNAL SYSTEMS v3.4 that originates from a vulnerability that allows an attacker to execute arbitrary code via the Input Title component...

Incorrect Default Permissions

Overview com.liferay:com.liferay.journal.web is a Liferay Journal Web Affected versions of this package are vulnerable to Incorrect Default Permissions due to the default assignment of view permissions to guest users for web content templates via the UI or API. Remediation Upgrade...

CVE-2024-25605

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attacke...

CVE-2024-25605

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attacke...

Code injection

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attacke...

CVE-2024-25605

The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions grants guest users view permission to web content templates by default, which allows remote attacke...

CVE-2024-25605

The CVE-2024-25605 issue affects Liferay Portal/DXP: The Journal module (versions 7.2.0–7.4.3.4; DXP 7.4.13; 7.3 before SP3; 7.2 before FP17) grants guest users view permission to web content templates by default, enabling viewing of templates via UI or API. Root cause is Incorrect/Default Permis...