python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through

There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's HTML Cleaner may be able to trigger script execution in clients such as web browsers. This can...

python-lxml: HTML Cleaner allows crafted and SVG embedded scripts to pass through

There's a flaw in python-lxml's HTML Cleaner component, which is responsible for sanitizing HTML and Javascript. An attacker who is able to submit a crafted payload to a web service using python-lxml's HTML Cleaner may be able to trigger script execution in clients such as web browsers. This can...

CVE-2022-27308

A stored cross-site scripting XSS vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a project title...

CVE-2022-27308: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a project title...

Debian DSA-5129-1 : firefox-esr - security update

The remote Debian 10 / 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5129 advisory. Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, information...

UBUNTU-CVE-2022-29911

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

CVE-2022-29911

An improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation could lead to script execution without allow-scripts being present. This vulnerability affects Thunderbird 91.9, Firefox ESR 91.9, and Firefox 100...

CVE-2022-27330

CVE-2022-27330 describes a cross-site scripting (XSS) vulnerability in the E-Commerce Website v1.0, exploitable through a crafted payload injected into the Product Title field when using the admin URL /public/admin/index.php?add_product. The vulnerability allows execution of arbitrary web scripts...

PT-2022-2617

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 91.9 Firefox ESR versions prior to 91.9 Firefox versions prior to 100 Description The issue is related to an improper implementation of the new iframe sandbox keyword allow-top-navigation-by-user-activation, which...

Security Vulnerabilities fixed in Thunderbird 91.9 — Mozilla

When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A...

Authentication flaw

Admin tool allows storing configuration data with script which may then get run by another vault administrator. Requires vault admin level authentication and is not remotely exploitable...

Xtend Cross-Site Scripting Vulnerabilities

Xtend is a general-purpose high-level programming language for the Eclipse Foundation's Java Virtual Machine. Xtend Voice Logger version 1.0 has a security vulnerability that stems from a cross-site scripting vulnerability in the error page. An attacker can use the vulnerability to execute...

PT-2022-11490

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue concerns an admin tool that allows storing configuration data with a script, which can then be executed by another vault administrator. This...

PT-2022-28260

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A reflected Cross Site Scripting issue has been identified. When a malicious request is sent to the "client registration endpoint", the error message is not properly escaped, allowing an...

CVE-2022-24735

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

ManageEngine ADSelfService Plus Custom Script Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine ADSelfService Plus Custom Script Execution', 'Description' = %q This module exploits the "custom script" feature of ADSelfService...

PT-2022-9390

Name of the Vulnerable Software and Affected Versions Eaton Intelligent Power Manager Infrastructure IPM Infrastructure versions 1.5.0plus205 and prior versions. Description The issue is related to a Stored Cross-site Scripting vulnerability. This vulnerability affects Eaton Intelligent Power...

PT-2022-18418

Name of the Vulnerable Software and Affected Versions Chamilo LMS version 1.11.13 Description A cross-site scripting XSS issue was found in the /blog/blog.php component. This allows for potential malicious script execution. Recommendations For Chamilo LMS version 1.11.13, consider disabling acces...

CVE-2021-43633

Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the receiver chat...

PT-2022-11875

Name of the Vulnerable Software and Affected Versions Sourcecodester Messaging Web Application version 1.0 Description The issue allows for stored XSS attacks. If a sender inserts valid scripts into the chat, the script will be executed on the receiver's chat. Recommendations For Sourcecodester...