PaperCut NG Security Vulnerability

PaperCut NG is a suite of next-generation printer control software from PaperCut Australia. A security vulnerability exists in PaperCut NG/MF that stems from the presence of a reflected cross-site scripting vulnerability that could allow an attacker to cause a limited loss of confidentiality,...

CVE-2024-21728

An Open Redirect vulnerability was found in osTicky2 below 2.2.8. osTicky osTicket Bridge by SmartCalc is a Joomla 3.x extension that provides Joomla fronted integration with osTicket, a popular Support ticket system. The Open Redirect vulnerability allows attackers to control the return paramete...

SmartCalc osTicky Security Vulnerability

SmartCalc osTicky is a Joomla extension that provides Joomla front-end integration with osTicket. A security vulnerability exists in SmartCalc osTicky versions prior to 2.2.8, which stems from a vulnerability that allows an attacker to control the return parameter in a URL to point to a malicious...

XoopsCore25 2.5.11 Cross Site Scripting

Title: XoopsCore25-2.5.11-XSS-Reflected Author: nu11secur1ty Date: 02/12/2024 Vendor: https://xoops.org/ Software: https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.11 Reference: https://portswigger.net/kb/issues/00200300cross-site-scripting-reflected Description: The value of the yname...

Design/Logic Flaw

An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL...

CVE-2024-24291

An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL...

Information Disclosure

jupyterlab is vulnerable to Information Disclosure. The vulnerability is due to a lack of URL validation or sanitization, which could potentially allow an attacker to craft a malicious URL that exposes sensitive information such as Authorization and XSRF tokens when the link is clicked on...

GHSA-5XFX-55X4-J223 Cross-Frame Scripting vulnerability has been found on Plone CMS

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...

Cross-Frame Scripting vulnerability has been found on Plone CMS

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...

CVE-2024-0669

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...

Cross site scripting

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...

MTN Group: DOM Based Reflected Cross Site Scripting

The outdated version of Swagger used by the notification-server-v2.sz-my.mtn.com asset was found to be vulnerable to a DOM-based reflected cross-site scripting vulnerability. The vulnerability was triggered by crafting a malicious URL that resulted in the execution of arbitrary scripts in the...

GHSA-QWF7-RV77-FCR3 Duplicate Advisory: Malicious URL drafting attack against iodines static file server may allow path traversal

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-85rf-xh54-whp3. This link is maintained to preserve external references. Original Description Path traversal in the static file service in Iodine less than 0.7.33 allows an unauthenticated, remote attacker to re...

Cross Site Request Forgery

Concrete CMS is vulnerable to Cross Site Request Forgery. The vulnerability is due improper implementation of anti csrf tokens within the following endpoint /ccm/system/dialogs/logs/deleteall/submit. This issue can be exploited by an attacker by sending malicious url to the authenticated admin to...

com.sdjictec.qdmetro Security Vulnerabilities

com.sdjictec.qdmetro is a component. A security vulnerability exists in com.sdjictec.qdmetro version 4.2.2, which originates in the component AdSdkH5Activity that allows an attacker to send and directly open a malicious URL, or download a malicious application...

CVE-2023-48583

Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting DOM-based XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2023-48500

Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2023-48498

Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2023-48449

Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting DOM-based XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2023-47322

The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery CSRF leading to privilege escalation. If an administrator goes to a malicious URL while being authenticated to the Silverpeas application, the CSRF with execute making the attacker an administrator user ...