4758 matches found
CVE-2022-30110
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
Cross site scripting
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
CVE-2022-30110
CVE-2022-30110 affects Jirafeau prior to version 4.4.0, where the File Preview feature (enabled by default) can execute injected JavaScript when an attacker uploads image/svg+xml files and a user visits the File Preview URL. This constitutes a cross-site scripting vector via preview rendering. Th...
CVE-2022-30110
The file preview functionality in Jirafeau 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file...
The Preview plugin in CKEditor allows Cross-site scripting (XSS)
Cross-site scripting XSS vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
GHSA-V27H-J97P-WQMX The Preview plugin in CKEditor allows Cross-site scripting (XSS)
Cross-site scripting XSS vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
Elefant CMS Multiple XSS Vulnerabilities
Multiple cross-site scripting XSS vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the 1 title or 2 body parameter to admin/preview...
Jirafeau 跨站脚本漏洞
Jirafeau is an easy way to upload files by the individual developer Jérôme Jutteau. A security vulnerability exists in Jirafeau versions prior to 4.4.0, which stems from a file preview feature enabled by default that can be used for cross-site scripting. An attacker could use this vulnerability t...
PT-2022-7558 · Unknown +6 · Wpe Webkit +6
Name of the Vulnerable Software and Affected Versions: WPE WebKit versions prior to 2.36.4 WebKitGTK versions prior to 2.36.4 Description: The issue is related to errors in resource release, allowing a remote attacker to impact data integrity. It involves a logic problem in handling concurrent...
Apple iOS和Apple iPadOS 资源管理错误漏洞
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A resource management error vulnerability exists in Apple iOS and Apple iPadOS, which arises from a logic issue in the vid...
Apple macOS Monterey 权限许可和访问控制问题漏洞
Apple macOS Monterey is the 18th major release of Apple's macOS for the Macintosh desktop operating system. Apple macOS Monterey versions 12.0 21A344 - 12.3.1 21E258 suffer from a Permission Granting and Access Control Issue vulnerability that stems from a plug-in that may be able to inherit...
Shiba vulnerable to XSS leading to code execution
Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration...
Shopware XSS Vulnerability
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...
GHSA-MVRX-CMQW-2JGJ Shopware XSS Vulnerability
Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the...
Bolt Cross-site Scripting (XSS) via text input click preview button
Bolt CMS 3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry...
FirmWire -b Full-System Baseband Firmware Emulation Platform For Fuzzing, Debugging, And Root-Cause Analysis Of Smartphone Baseband Firmwares
FirmWire is a full-system baseband firmware analysis platform that supports Samsung and MediaTek. It enables fuzzing, root-cause analysis, and debugging of baseband firmware images. See theFirmWire documentation to get started! Experiments & Missing Parts? Upon a vendor's request, the current...
Google Releases First Developer Preview of Privacy Sandbox on Android 13
Google has officially released the first developer preview for the Privacy Sandbox on Android 13, offering an "early look" at the SDK Runtime and Topics API to boost users' privacy online. "The Privacy Sandbox on Android Developer Preview program will run over the course of 2022, with a beta...
GHSA-6CJ8-C359-P7Q9 Drupal vulnerable to Cross-site Scripting
Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...
