PT-2024-14572 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns improper control over foreground service notifications in the notification module. Successful exploitation may affect service confidentiality. Recommendations: At...

Cross-site Scripting (XSS)

neos/neos is vulnerable to cross-site scriptingXSS attacks. The library does not properly escape the HTML content in notification module, allowing an attacker to inject and execute malicious javascript on victim's browser...

XSS in various backend modules due to (un)escaping in JS notification module

The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities eg. workspace title or media title. This however means you must be a logged in user with respective rights in the first place to...