8974 matches found
MarkText vulnerable to cross-site scripting
Overview MarkText is a Markdown editor. MarkText contains a cross-site scripting vulnerability CWE-79. Eiji Mori of Flatt Security Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may...
MarkText cross-site scripting vulnerabilities
MarkText is a simple and elegant Markdown editor with a focus on speed and usability.A cross-site scripting vulnerability exists in versions of MarkText prior to 0.17.0, which stems from improper handling of links using javascript:scheme in documents. A remote attacker could exploit this...
PT-2022-28281
Name of the Vulnerable Software and Affected Versions Advanced Rest Client versions prior to 17.0.9 Description The issue allows scripts embedded in a link target to execute any logic that Advanced Rest Client has access to from the renderer process. This includes file system access, data store...
PT-2022-17095
Name of the Vulnerable Software and Affected Versions Axelor Open Suite version 5.0 Description A stored cross-site scripting XSS issue was found, which can be exploited via the Name parameter. This allows for malicious script execution when the stored data is viewed. Recommendations For Axelor...
Security update for MozillaFirefox (moderate)
openSUSE Security Update: Security update for MozillaFirefox Announcement ID: openSUSE-SU-42022-1 Rating: moderate References: 1038980 1191962 1191963 1192153 1192154 1192696 1195230 1195682 Cross-References: CVE-2017-8923 CVE-2021-23343 CVE-2021-32803 CVE-2021-32804 CVE-2021-3807 CVE-2021-3918...
CVE-2022-22944
VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window...
CVE-2022-25020
A cross-site scripting XSS vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post...
Librenms cross-site scripting vulnerabilities
Librenms is a PHP and MySQL based open source network monitoring system from the Librenms community. The system features custom alerts, auto-discovery of network environments and automatic updates.Librenms suffers from a cross-site scripting vulnerability that stems from the lack of proper...
PT-2022-13389
Name of the Vulnerable Software and Affected Versions microweber/microweber versions prior to 1.2.11 Description The issue is related to Cross-site Scripting XSS - Reflected. This means an attacker can inject malicious scripts into a website, which are then executed by the user's browser. No...
Notimoo Cross-Site Scripting Vulnerability
Notimoo is a method for web developers to display notifications to users. PaquitoSoftware Notimoo suffers from a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary web script or HTML via a carefully crafted header or message in a notification...
QNAP QTS Proxy Server cross-site scripting vulnerability
Qnap Systems QNAP QTS is a data storage device with SAN-like storage architecture from China Weilian Tong Qnap Systems. The device supports tiered storage, mirror protection, and other security features. A cross-site scripting vulnerability exists in the QNAP QTS Proxy Server, which stems from...
SUSE-SU-2022:0565-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 bsc1195682 - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during upda...
SUSE-SU-2022:14896-1 Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues: Firefox Extended Support Release 91.6.0 ESR / MFSA 2022-05 bsc1195682 - CVE-2022-22753: Privilege Escalation to SYSTEM on Windows via Maintenance Service - CVE-2022-22754: Extensions could have bypassed permission confirmation during upda...
SUSE: Security Advisory (SUSE-SU-2022:14896-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OPENSUSE-SU-2022:0559-1 Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 91.6.1 / MFSA 2022-07 bsc1196072 CVE-2022-0566 bmo1753094 Crafted email could trigger an out-of-bounds write - Mozilla Thunderbird 91.6 / MFSA 2022-06 bsc1195682 CVE-2022-22753 bmo1732435 Privilege Escalation to...
PT-2022-16817
Name of the Vulnerable Software and Affected Versions Anuko Time Tracker versions prior to 1.20.0.5646 Description Anuko Time Tracker is an open source, web-based time tracking application written in PHP. The issue arises from the ttUser.class.php file not escaping the primary group name for...
PT-2022-12184
Name of the Vulnerable Software and Affected Versions FUEL-CMS version 1.5.1 Description A Cross Site Scripting XSS issue exists in the Assets page via an SVG file. This allows for potential malicious script execution. Recommendations For FUEL-CMS version 1.5.1, consider restricting the upload of...
Multiple vulnerabilities in phpUploader
Overview phpUploader provided by Dojin Club MICMNIS contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2022-24435 SQL Injection CWE-89 - CVE-2022-23986 Toyama Taku reported these vulnerabilities to IPA. JPCERT/CC coordinated with the developer under Information...
Cisco Prime Infrastructure Cross-site Scripting Vulnerabilities
Cisco Prime Infrastructure is an application from Cisco, Inc. A cross-site scripting vulnerability exists in Cisco Prime Infrastructure and Cisco EPN Manager, which could be exploited by an attacker to execute arbitrary script code or access sensitive browser-based information in the context of t...
