K04524282: XSS vulnerability in undisclosed TMUI page CVE-2018-15314

Security Advisory Description A reflected Cross-Site Scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to execute JavaScript in the context of the current logged-in user. CVE-2018-15314 Impact BIG-IP A remote unauthenticated...

SUSE CVE-2018-2836

Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization subcomponent: Core. Supported versions that are affected are Prior to 5.1.36 and Prior to 5.2.10. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBo...

SUSE CVE-2018-16586

In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...

SUSE CVE-2021-2124

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.18. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

SUSE CVE-2022-21394

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...

SUSE CVE-2022-21571

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.36. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromis...

CVE-2023-22375

Cross-site request forgery CSRF vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to hijack the authentication and conduct arbitrary operations by having a logged-in user to view a malicious page. NOTE: This vulnerability...

PT-2023-2969 · Faronics · Faronics Insight

Name of the Vulnerable Software and Affected Versions: Faronics Insight version 10.0.19045 Description: The issue is related to the Teacher Console component of the Faronics Insight platform, which fails to protect the web page structure when handling the loggedInUser field. This can be exploited...

SLIMS 9.5.2 Cross Site Scripting Vulnerability

Title: SLIMS-9.5.2 - XSS Reflected - Account Exploit Development: nu11secur1ty Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/tag/v9.5.2 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.2 Description:...

Post Status Notifier Lite < 1.10.1 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin. Make a logged in high privilege user such as admin open the URL below...

CVE-2022-3946

The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods...

PT-2022-24034 · WordPress · Booster Elite For Woocommerce +2

Name of the Vulnerable Software and Affected Versions: Booster for WooCommerce WordPress plugin versions prior to 5.6.7 Booster Plus for WooCommerce WordPress plugin versions prior to 5.6.5 Booster Elite for WooCommerce WordPress plugin versions prior to 1.1.7 Description: The issue allows...

Session fixation

Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user...

Cross site scripting

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage...

CVE-2022-41789 Potential XSS on default page header

Cross-site Scripting XSS vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage...

PT-2022-26074 · Bluespice · Bluespice

Name of the Vulnerable Software and Affected Versions: BlueSpice affected versions not specified Description: The issue allows a logged-in user with edit permissions to inject arbitrary HTML into the default page header of a wiki page due to a Cross-site Scripting XSS vulnerability in the...

CVE-2022-30769

Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user...

CVE-2022-38660

HCL XPages applications are susceptible to a Cross Site Request Forgery CSRF vulnerability. An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user...

PT-2022-24510 · Hcl · Hcl Xpages

Name of the Vulnerable Software and Affected Versions: HCL XPages affected versions not specified Description: The issue is related to a Cross Site Request Forgery CSRF vulnerability, which allows an unauthenticated attacker to perform actions in the application on behalf of the logged-in user...

HCL Technologies XPages Cross-Site Request Forgery Vulnerability

HCL Technologies XPages is an XML interpreted by a Domino server or Notes client and rendered in a web browser or Notes client by HCL Technologies India. A security vulnerability exists in HCL Technologies XPages that stems from the presence of cross-site request forgery CSRF, which can be...