1926 matches found
Cross site scripting
An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot...
Design/Logic Flaw
An issue was discovered in app/View/Elements/Events/View/valuefield.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascript:// links...
CVE-2019-11812
A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link...
CVE-2019-11813
An issue was discovered in app/View/Elements/Events/View/valuefield.ctp in MISP before 2.4.107. There is persistent XSS via link type attributes with javascript:// links...
CVE-2019-11814
An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles, as demonstrated by a screenshot...
CVE-2019-11813
CVE-2019-11813 applies to MISP before 2.4.107, affecting the view component app/View/Elements/Events/View/value_field.ctp. The issue is a persistent XSS via link type attributes using javascript:// links, enabling potentially scripted payloads in affected installations. Root cause is improper han...
CVE-2019-11812
A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface, and can be triggered by clicking on the link...
CVE-2019-11812
CVE-2019-11812 is a persistent XSS in MISP prior to 2.4.107. The vulnerability is in the PHP component app/View/Helper/CommandHelper.php, where JavaScript can be injected via the discussion interface and triggered by clicking a link. Affected product/version: MISP (before 2.4.107). Root cause is ...
CVE-2018-18643
GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...
Cross site scripting
GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...
CVE-2018-18643
GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...
CVE-2018-18643
Removed by vendor...
CVE-2018-18643
GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS...
CVE-2018-18643
CVE-2018-18643 affects GitLab CE & EE versions 11.2 and later, up to but not including 11.5.0-rc12, and includes 11.4.6 and 11.3.10. The vulnerability is a Persistent XSS issue described in the CVE entry. The provided connected documents confirm the existence of a persistent cross‑site scripting ...
CVE-2019-10893
CVE-2019-10893 affects CentOS Web Panel versions 0.9.8.793 (Free) and 0.9.8.753 (Pro). It is a stored/persistent XSS in the Admin Email field on the CWP Settings > Edit Settings screen, triggered by saving a crafted email value, with the payload executing in the admin context. Root cause state...
CVE-2019-6796
An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS issue 2 of 2. The user status field contains a lack of input validation and output encoding that results in a persistent XSS...
CVE-2019-6796
Removed by vendor...
Automattic: WooCommerce: Persistent XSS via customer address (state/county)
Persistent XSS via customer address state/county ================================ CVSS ---- High 7.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Description ----------- The current version 3.5.7 of the WooCommerce WordPress plugin echoes the state/county of a customer in the admin backend withou...