PT-2022-11889

Name of the Vulnerable Software and Affected Versions Maccms version 10 Description A Cross Site Scripting XSS issue exists due to the link Name parameter. This allows for potential malicious script execution. Recommendations For Maccms version 10, avoid using the link Name parameter until a fix ...

PT-2022-18137

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.10 Description The issue is a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying...

PT-2022-17737

Name of the Vulnerable Software and Affected Versions Hospital Patient Record Management System version 1.0 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the special field. This enables attackers t...

PT-2022-12013

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.5 and earlier Description The issue allows for cross-site scripting XSS attacks via an HTML 5 element, such as AUDIO. This can potentially lead to malicious script execution on the client-side. Recommendations For OX...

Parsedown Class-Name Injection

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

PT-2022-17750

Name of the Vulnerable Software and Affected Versions Yonyou u8 version 13.0 Description A DOM-based cross-site scripting XSS issue was found in the component /u8sl/WebHelp, which can be exploited to execute malicious scripts. Recommendations For Yonyou u8 version 13.0, consider restricting acces...

WordPress and WordPress plugins have cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

showdoc .m3u8a file upload vulnerability

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .m3u8a file extensions in the application's file upload feature. An attacker could exploit this...

CVE-2022-0893

Cross-site Scripting XSS - Stored in GitHub repository pimcore/pimcore prior to 10.4.0...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .md file extensions in the application's file upload feature. An attacker could use this vulnerability to...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .aspx file extensions in the application's file upload functionality. An attacker could use this...

JVN#87751554: Multiple vulnerabilities in pfSense

pfSense software provided by Netgate contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2021-20729 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 Improper...

PT-2022-12995

Name of the Vulnerable Software and Affected Versions The Cookie Information | Free GDPR Consent Solution WordPress plugin versions prior to 2.0.8 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly escape user data before...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool ideal for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability, which stems from the lack of valid detection of .aspx file extensions in the application's file upload feature. An attacker could exploit this...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could exploit this...

CVE-2022-0880

Cross-site Scripting XSS - Stored in GitHub repository star7th/showdoc prior to 2.10.2...

CVE-2022-21158

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

CVE-2022-21158: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link with javascript: scheme inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext...

CVE-2022-24177: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scripts or HTML...

SUSE-SU-2022:0696-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 bsc1195682 - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during upda...