Organizer code issue vulnerabilities

Organizr is a tab management system. Designed to be a one-stop store for server front ends, Organizr versions prior to 2.1.1810 have a file upload vulnerability that stems from the lack of valid validation of uploaded files by the application, which can be exploited by attackers to upload .svg...

PT-2022-13816

Name of the Vulnerable Software and Affected Versions causefx/organizr versions prior to 2.1.1810 Description The issue allows attackers to execute malicious scripts in the user's browser, potentially leading to session hijacking, sensitive data exposure, and other severe consequences. This is du...

CVE-2022-26105

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

CVE-2022-26105

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

CVE-2022-26105

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

Design/Logic Flaw

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

CVE-2022-26105

CVE-2022-26105 affects SAP NetWeaver Enterprise Portal versions 7.10 through 7.50. The issue is described as an unauthenticated script execution vulnerability due to improper sanitization of user inputs during network interaction, leading to potential view/modify of information with limited impac...

CVE-2022-26105

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

Cross-site Scripting (XSS)

privatebin is vulnerable to cross-site scripting. No sanitization in handling Attachment before sending for preview in SVG in AttachmentViewer allows malicious script execution in instance context...

CVE-2022-26105: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, is susceptible to script execution attack by an unauthenticated attacker due to improper sanitization of the user inputs while interacting on the Network. On successful exploitation, an attacker can view or modif...

PT-2022-17675

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal versions 7.10 through 7.50 Description The issue is related to improper sanitization of user inputs, allowing an unauthenticated attacker to execute scripts. This can lead to viewing or modifying information,...

Webmin cross-site scripting vulnerabilities

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site scripting vulnerability exists in Webmin version 1.973, which stems from the lack of filtering and escaping of user-submitted parameters for the upload and download...

CVE-2022-1290

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

PT-2022-18200

Name of the Vulnerable Software and Affected Versions AeroCMS version 0.0.1 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field in add post.php. This enables the execution of malicious code on the web...

PT-2022-16548

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server Example versions prior to 7.0.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary HTML or JavaScript through the "/example/editor" API endpoint. This enables attackers to execut...

CVE-2022-26676: Improper Privilege Management

aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service...

PT-2022-18004

Name of the Vulnerable Software and Affected Versions aEnrich a+HRD affected versions not specified Description The issue is related to inadequate privilege restrictions in aEnrich a+HRD, allowing an unauthenticated remote attacker to use an API function to upload and execute malicious scripts...

UBUNTU-CVE-2022-28284

SVG's use element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with...

Cisco Web Security Appliance and Cisco AsyncOS have cross-site scripting vulnerabilities

The Cisco Web Security Appliance WSA and Cisco AsyncOS are both products of Cisco, U.S.A. The Cisco Web Security Appliance is a Web security appliance. The appliance provides SaaS-based access control, real-time web reporting and tracking, and development of security policies.Cisco AsyncOS is an...

CVE-2022-26615

A cross-site scripting XSS vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields...