860 matches found
Code injection
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535...
CVE-2020-4805
CVE-2020-4805 affects IBM Edge 4.2 and is described as a local information-disclosure vulnerability where web pages can be stored locally and read by another user on the same system. IBM’s bulletin confirms a cache-control vulnerability with a remediation: upgrade via a set of docker images pulle...
CVE-2020-4803
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189535...
PT-2021-12182
Name of the Vulnerable Software and Affected Versions IBM Edge version 4.2 Description The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations For IBM Edge version 4.2, consider restricting access to locally stored web pages to minimi...
PT-2021-12181
Name of the Vulnerable Software and Affected Versions IBM Edge version 4.2 Description The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations For IBM Edge version 4.2, consider restricting access to locally stored web pages to minimi...
PT-2021-12180
Name of the Vulnerable Software and Affected Versions IBM Edge version 4.2 Description The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations For IBM Edge version 4.2, consider restricting access to locally stored web pages to minimi...
CVE-2020-4809
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189633...
IBM Edge 安全漏洞
Edge is a Node.js logic and template engine that contains batteries. IBM Edge is vulnerable to an information disclosure vulnerability that stems from the program allowing web pages to be stored locally, which could be exploited by an attacker to read those pages...
CVE-2020-4805
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539...
Cross-site Scripting in peertube
peertube is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'. It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored i...
GHSA-F2C5-997W-7F5C Cross-site Scripting in peertube
peertube is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'. It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored i...
PT-2021-21873
Name of the Vulnerable Software and Affected Versions: peertube affected versions not specified Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. It allows an attacker to upload an SVG image and share its URL with...
Cross-site Scripting (XSS) - Stored in chocobozzz/peertube
✍️ Description We can upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers. 🕵️♂️ Proof of Concept 1.Go to...
Cross-site Scripting (XSS) - Reflected in zoujingli/thinkadmin
✍️ Description The Application is Vulnerable to reflected XSS Attack. 🕵️♂️ Proof of Concept Open the following page in the browser as admin. The 商品名称 field is vulnerable to reflected XSS. An alert box is displayed as PoC...
U.S. Dept Of Defense: Cross site scripting
Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of unvalidated or unencoded user input within the output it generates. Impact Malicious...
ceph-dashboard: Cross-site scripting via token Cookie
A flaw was found in the Red Hat Ceph Storage Dashboard. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS. The greatest threa...
ceph-dashboard: Don't use Browser's LocalStorage for storing JWT but Secure Cookies with proper HTTP Headers
A flaw was found in ceph-dashboard. The JSON Web Token JWT used for user authentication is stored by the frontend application in the browser’s localStorage which is potentially vulnerable to attackers via XSS attacks. The highest threat from this vulnerability is to data confidentiality and...
PT-2021-13933
Name of the Vulnerable Software and Affected Versions: IBM QRadar Analyst Workflow App versions 1.0 through 1.18.0 for IBM QRadar SIEM Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For versions 1.0 through...
