CVE-2021-32622

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the previ...

CVE-2021-32622

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the previ...

CVE-2021-32622

CVE-2021-32622 affects the Matrix-React-SDK (Matrix-React-SDK) prior to version 3.21.0. The vulnerability arises during file uploads: when a user previews an uploaded file, scripts embedded in the file can execute, but only for the local user and only after several user interactions to open the p...

Moodle: Cross-site scripting vulnerabilities

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A cross-site scripting vulnerability exists in Moodle, which can be exploited to inject and execute arbitrary HTML and script code in ...

CVE-2021-32622: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the previ...

PT-2021-19814

Name of the Vulnerable Software and Affected Versions Matrix-React-SDK versions prior to 3.21.0 Description The issue arises when uploading a file, as the local file preview can lead to the execution of scripts embedded in the uploaded file. This occurs after several user interactions to open the...

PT-2021-19783

Name of the Vulnerable Software and Affected Versions OctoPrint versions prior to 1.6.0 Description The issue allows for XSS because API error messages include the values of input parameters, such as username or other user-provided data. This can lead to malicious scripts being executed on the...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

Cross site scripting

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

CVE-2021-20717

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

EC-CUBE vulnerable to cross-site scripting

Overview EC-CUBE provided by EC-CUBE CO.,LTD. contains a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by executing a specific operation on the management page of EC-CUBE. As of 2021 May 10, an attack exploting this vulnerability has been observed in the wild...

CVE-2021-20717: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

PT-2021-14176

Name of the Vulnerable Software and Affected Versions: EC-CUBE versions 4.0.0 through 4.0.5 Description: A cross-site scripting issue allows a remote attacker to inject a specially crafted script in a specific input field of the EC web site created using EC-CUBE, potentially leading to arbitrary...

PT-2021-19681 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle version 3.10.3 Description: The issue allows remote attackers to execute arbitrary web script or HTML via the Description field, which is a Cross Site Scripting XSS issue. Recommendations: For Moodle version 3.10.3, update to a newer...

PT-2021-19587

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2020.2.3 Description: The issue allows for reflected XSS on several pages, which can lead to malicious script execution. Recommendations: For versions prior to 2020.2.3, update to version 2020.2.3 or later...

PT-2021-19583

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2020.2.3 Description: The issue allows for stored XSS on several pages, which can lead to malicious script execution. Recommendations: For versions prior to 2020.2.3, update to version 2020.2.3 or later to...

PT-2021-20056

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2020.2.2 Description The issue allows for stored XSS on a tests page, which could potentially lead to malicious script execution. Recommendations For versions prior to 2020.2.2, update to version 2020.2.2 o...

CVE-2021-1507

A vulnerability in an API of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against users of the application web-based interface. This vulnerability exists because the API does not properly validate user-supplied...

PT-2021-15802

Name of the Vulnerable Software and Affected Versions WooLentor – WooCommerce Elementor Addons + Builder versions prior to 1.8.6 Description The issue concerns a stored Cross-Site Scripting XSS vulnerability in a widget of the plugin, which can be exploited by lower-privileged users, such as...