CVE-2022-0958 Mark Posts < 2.0.1 - Admin+ Stored Cross-Site Scripting

The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2022-0958

CVE-2022-0958 affects the WordPress Mark Posts plugin prior to version 2.0.1, where the plugin does not escape new markers, enabling stored Cross-Site Scripting by high-privilege users (e.g., admins) when the unfiltered_html capability is disallowed. This is documented across multiple sources (NV...

WordPress plugin Mark Posts 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Mark Posts plugin has a cross-site scripting...

WordPress Product Table for WooCommerce plugin <= 3.1.1 - Unauthenticated Arbitrary Option Change vulnerability

Unauthenticated Arbitrary Option Change vulnerability discovered by Mark Costlow in WordPress Product Table for WooCommerce plugin versions = 3.1.1. Solution Update the WordPress Product Table for WooCommerce plugin to the latest available version at least 3.1.2...

Mark Posts < 2.0.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the 'Add new markers' settings of the plugin: "autofocus onfocus=alert/XSS/ b=...

WordPress Mark Posts plugin <= 2.0.0 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by fuzzyap1 in WordPress Mark Posts plugin versions = 2.0.0. Solution Update the WordPress Mark Posts plugin to the latest available version at least 2.0.1...

Mark Posts < 2.0.1 - Admin+ Stored Cross-Site Scripting

The plugin does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the 'Add new markers' settings of the plugin: "autofocus onfocus=alert/XSS/ b=...

CVE-2022-21158

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

Mark Text Cross-Site Scripting Vulnerability (CNVD-2022-21485)

Mark Text is a Markdown editor built on Electron for individual developers. v0.16.3 of Mark Text contains a security vulnerability that could be exploited to execute remote code by injecting a crafted payload into /lib/contentState/pasteCtrl.js...

CVE-2022-25069

Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting XSS vulnerability which allows attackers to perform remote code execution RCE via injecting a crafted payload into /lib/contentState/pasteCtrl.js...

CVE-2022-25069

Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting XSS vulnerability which allows attackers to perform remote code execution RCE via injecting a crafted payload into /lib/contentState/pasteCtrl.js...

Cross site scripting

Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting XSS vulnerability which allows attackers to perform remote code execution RCE via injecting a crafted payload into /lib/contentState/pasteCtrl.js...

CVE-2022-25069

Mark Text v0.16.3 contains a DOM-based XSS vulnerability in /lib/contentState/pasteCtrl.js that can lead to remote code execution (RCE). Root cause: DOM-based XSS in pasteCtrl.js allows crafted payloads to be executed. Impact: high/critical (CVSS3.1 base score 9.6) with network access and user in...

CVE-2022-25069

Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting XSS vulnerability which allows attackers to perform remote code execution RCE via injecting a crafted payload into /lib/contentState/pasteCtrl.js...

CVE-2022-25069

Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting XSS vulnerability which allows attackers to perform remote code execution RCE via injecting a crafted payload into /lib/contentState/pasteCtrl.js...

Mark Text 跨站脚本漏洞

Mark Text is a Markdown editor built on Electron for individual developers. v0.16.3 of Mark Text contains a security vulnerability that could be exploited to execute remote code by injecting a crafted payload into /lib/contentState/pasteCtrl.js...

mark-neugebauer.de Improper Access Control vulnerability OBB-2397246

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

virt:kvm_utils security update

hivex 1.3.18-21 - Bounds check for block exceeding page length CVE-2021-3504 resolves: rhbz1950501 libguestfs 1.40.2-28.0.1 - Replace upstream references from description tag - Config supermin to use host yum.conf in ol8 Orabug: 29319324 - Set DISTROORACLELINUX correspeonding to ol 1:1.40.2-28 -...

Microsoft Windows Explorer Preview Pane Security Bypass

Exploit Title: Windows Explorer Preview Pane WMV/WMA media Automatic URI Opening Vulnerability Google Dork: n/a Date: December 25th, 2021 Exploit Author: Eduardo Braun Prado Vendor Homepage: http://www.microsoft.com/ Software Link: http://www.microsoft.com/ Version: Windows 7, 8.1, 10, 11 x86/x64...

CLSA-2021-1639686040 Fix CVE(s): CVE-2021-3984, CVE-2021-3973, CVE-2021-3974, CVE-2021-4019, CVE-2021-4069

SECURITY UPDATE: Using freed memory with regexp using a mark - debian/patches/CVE-2021-3974.patch: Get the line again after getting the mark position - CVE-2021-3974 SECURITY UPDATE: Illegal memory access when C-indenting - debian/patches/CVE-2021-3984.patch: Also set the cursor column -...