Cross-site Scripting (XSS)

Overview org.jenkins-ci:winstone is a command line wrapper around Jetty. Affected versions of this package are vulnerable to Cross-site Scripting XSS via error messages. An attacker can inject arbitrary web script or HTML by crafting malicious input that triggers these error messages. Details...

GHSA-Q3RP-555R-HH6R Jenkins allows Cross-Site Scripting (XSS)

Cross-site scripting XSS vulnerability in Jenkins Core in Jenkins before 1.438, and 1.409 LTS before 1.409.3 LTS, when a stand-alone container is used, allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

concrete5 vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via vectors related to private messages or other unspecified vectors. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker...

Improper Input Validation in Apache Axis2

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server WAS 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly...

GHSA-Q326-JHW3-699G Improper Neutralization of Input During Web Page Generation in IPython

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

Improper Neutralization of Input During Web Page Generation in IPython

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

GHSA-545F-PGP7-FWJF Log value insertion in craftercms

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator...

Log value insertion in craftercms

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator...

Apache ShenYu 安全漏洞

A denial-of-service vulnerability exists in Apache ShenYu, an asynchronous, high-performance, cross-language, responsive API gateway from the Apache Foundation, which stems from a failure to properly handle incoming error messages and can be exploited by attackers to pass in malicious regular...

Envato WoWonder 安全漏洞

Envato WoWonder is an application from the Australian company Envato. It provides a PHP social networking script. A security vulnerability exists in Envato WoWonder. An attacker could use this vulnerability to post messages in other groups via the groupid operation...

The vulnerability of Mozilla Thunderbird’s email client lies in the improper processing of user-input data when dealing with signed and encrypted embedded messages. This allows attackers to perform spamming attacks.

The vulnerability in Mozilla Thunderbird’s email client allows for incorrect processing of user-input data when dealing with signed and encrypted embedded messages. Exploiting this vulnerability can enable a malicious actor to carry out spam attacks by sending specially crafted email messages...

CLSA-2022-1652732686 Fixed CVE-2021-28116 in libecap-2.module_el8.5.0+2035+9782b8ab

CVE-2021-28116: Fix out of bound access when processing WCCPv2 messages...

CVE-2021-23266

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator...

CVE-2021-23266

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator...

CVE-2021-23266

Crafter CMS (Crafter Studio) vulnerability CVE-2021-23266 allows anonymous users to craft a URL whose text is displayed verbatim in the log viewer, enabling misleading admin messages. Root cause: improper output neutralization for logs. Affected component: Crafter Studio log viewer. No remediatio...

CVE-2021-23266

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator...

WordPress plugin WPQA 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plug-in. An access control error vulnerability exists in versions of WordPress WPQA plugin prior to 5.2, whic...

GHSA-WMHW-HPWH-44PG Apache ActiveMQ Apollo XXE Vulnerability

XML external entity XXE vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages...

Apache ActiveMQ Apollo XXE Vulnerability

XML external entity XXE vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages...