UBUNTU-CVE-2022-29911

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

CVE-2022-29911

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

CVE-2022-27330

CVE-2022-27330 describes a cross-site scripting (XSS) vulnerability in the E-Commerce Website v1.0, exploitable through a crafted payload injected into the Product Title field when using the admin URL /public/admin/index.php?add_product. The vulnerability allows execution of arbitrary web scripts...

PT-2022-2617

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 91.9 Firefox ESR versions prior to 91.9 Firefox versions prior to 100 Description The issue is related to an improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation, which...

Security Vulnerabilities fixed in Thunderbird 91.9 — Mozilla

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A...

Authentication flaw

Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable...

Xtend Cross-Site Scripting Vulnerabilities

Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...

PT-2022-11490

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue concerns an admin tool that allows storing configuration data with a script, which can then be executed by another vault administrator. This...

PT-2022-28260

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A reflected Cross Site Scripting issue has been identified. When a malicious request is sent to the "client registration endpoint", the error message is not properly escaped, allowing an...

CVE-2022-24735

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

ManageEngine ADSelfService Plus Custom Script Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine ADSelfService Plus Custom Script Execution', 'Description' = %q This module exploits the "custom script" feature of ADSelfService...

PT-2022-9390

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager Infrastructure IPM Infrastructure versions 1.5.0plus205 and prior versions. Description The issue is related to a Stored Cross-site Scripting vulnerability. This vulnerability affects Eaton Intelligent Power...

PT-2022-18418

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A cross-site scripting XSS issue was found in the /blog/blog.php component. This allows for potential malicious script execution. Recommendations For Chamilo LMS version 1.11.13, consider disabling acces...

CVE-2021-43633

Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the receiver chat...

PT-2022-11875

Name of the Vulnerable Software and Affected Versions Sourcecodester Messaging Web Application version 1.0 Description The issue allows for stored XSS attacks. If a sender inserts valid scripts into the chat, the script will be executed on the receiver's chat. Recommendations For Sourcecodester...

Organizer code issue vulnerabilities

Organizr is a tab management system. Designed to be a one-stop store for server front ends, Organizr versions prior to 2.1.1810 have a file upload vulnerability that stems from the lack of valid validation of uploaded files by the application, which can be exploited by attackers to upload .svg...

PT-2022-13816

Name of the Vulnerable Software and Affected Versions causefx/organizr versions prior to 2.1.1810 Description The issue allows attackers to execute malicious scripts in the user's browser, potentially leading to session hijacking, sensitive data exposure, and other severe consequences. This is du...

CVE-2022-26105

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

CVE-2022-26105

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

CVE-2022-26105

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...