Google Chrome < 106.0.5249.61 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 106.0.5249.61. It is, therefore, affected by multiple vulnerabilities as referenced in the 202209stable-channel-update-for-desktop27 advisory. - Use after free in ChromeOS Notifications in Google Chrome on ChromeOS prio...

CVE-2022-40044

Centreon v20.10.18 was discovered to contain a cross-site scripting XSS vulnerability via the escname Escalation Name parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2022-40044

Centreon v20.10.18 was discovered to contain a cross-site scripting XSS vulnerability via the escname Escalation Name parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2022-40043

Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the escname Escalation Name parameter at Configuration/Notifications/Escalations...

CVE-2022-40044

Centreon v20.10.18 was discovered to contain a cross-site scripting XSS vulnerability via the escname Escalation Name parameter at Configuration/Notifications/Escalations. This vulnerability allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2022-40043

CVE-2022-40043 affects Centreon v20.10.18, where a SQL injection vulnerability exists in the esc_name parameter of Configuration/Notifications/Escalations. The root cause is lack of validation of externally entered SQL statements, enabling potential unauthorized SQL execution and data access. Imp...

CVE-2022-40043

Centreon v20.10.18 was discovered to contain a SQL injection vulnerability via the escname Escalation Name parameter at Configuration/Notifications/Escalations...

Centreon SQL注入漏洞

Centreon Merethis Centreon is a set of open source system monitoring tools from the French company Centreon . A SQL injection vulnerability exists in Centreon v20.10.18, which stems from the escname Escalation Name parameter of its Configuration/Notifications/Escalations component Lack of...

Stored XSS in Notifications

Description It is possible to create a notification with stored XSS which can result in the JavaScript code execution. Notifications can only be created while logged in on user with admin privileges, but once notification is created any user can see it. Proof of Concept Create notification with...

CVE-2022-41322

In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacker-controlled content in the terminal, then click on a notification popup...

Welcome to high tech hacking in 2022: Annoying users until they say "yes"

Last week we learned that ride-sharing giant Uber's defences had been unpicked by an attacker with a novel take on social engineering: Fatigue. Fatigue attacks play on the often repetitive nature of certain security procedures and failsafes. Do you hate having to punch in a password on your login...

Cross-site Request Forgery (CSRF)

rdiffweb is vulnerable to cross-site request forgery. The vulnerability exists in renderprefspanel function in prefnotification.py because the server accepts the GET request that is sent to modify repository notifications settings which allows an attacker to disable the notifications sent to user...

Stored XSS vulnerability in Jenkins DotCi Plugin

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted commit notifications to the...

GHSA-Q9G4-9FX4-V533 Stored XSS vulnerability in Jenkins DotCi Plugin

DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to submit crafted commit notifications to the...

GHSA-9VXF-MCM6-5M42 rdiffweb CSRF could lead to disabling notifications in user profile

rdiffweb prior to 2.4.6 is vulnerable to Cross-Site Request Forgery CSRF, which could lead to disabling notifications in a user's profile...

rdiffweb CSRF could lead to disabling notifications in user profile

rdiffweb prior to 2.4.6 is vulnerable to Cross-Site Request Forgery CSRF, which could lead to disabling notifications in a user's profile...

Stored Cross-Site Scripting (XSS)

Description There is insufficient input validation in the pop-up notifications. Proof of Concept Steps to reproduce: 1. Log in to an admin account 2. Click on Ports - Manage Groups 3. Create a new Port Group with the Name alertdocument.location and an arbitrary Description 4. The XSS is triggered...

Stored Cross-Site Scripting (XSS)

Description There is insufficient input validation in the title of user notifications. Proof of Concept Steps to reproduce: 1. Log in to an admin account 2. Hover over the username & click on Notifications 3. Create a new notification with the Title alertdocument.location and an arbitrary message...

CVE-2022-41239

Jenkins DotCi Plugin 2.40.00 and earlier does not escape the GitHub user name parameter provided to commit notifications when displaying them in a build cause, resulting in a stored cross-site scripting XSS vulnerability...

Jenkins DotCi Plugin 跨站脚本漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A cross-site scripting...