CVE-2022-36417

CVE-2022-36417 concerns the WordPress plugin 3D Tag Cloud (Cardoza) up to version ≤ 3.8. The connected sources confirm a Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in this plugin. The root cause indicated across multiple records is lack of proper request...

bigbikethaizone.com Cross Site Scripting vulnerability OBB-2943323

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

GHSA-WFFM-J7M8-93G4 Liferay Portal and Liferay DXP Vulnerable to XSS via Tag Name

A cross-site scripting XSS vulnerability in Liferay Asset Taglib before v6.1.9 from Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag...

WordPress plugin 3D Tag Cloud 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Cross site scripting

A cross-site scripting XSS vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag...

WordPress 3D Tag Cloud plugin <= 3.8 - Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability

Multiple Stored Cross-Site Scripting XSS via Cross-Site Request Forgery CSRF vulnerability discovered by Rasi Afeef in WordPress 3D Tag Cloud plugin versions = 3.8. Solution No patched version is available. No reply from the vendor...

CVE-2022-28982

A cross-site scripting XSS vulnerability in Liferay Portal v7.3.3 through v7.4.2 and Liferay DXP v7.3 before service pack 3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name of a tag...

GHSA-GM8C-W9CM-C445 Microweber vulnerable to HTML Injection in create tag functionality

HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. A patch is available on commit...

The vulnerability of the Mozilla Firefox browser, related to the disclosure of information, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Mozilla Firefox browser is related to the exposure of information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information using a specially created image tag...

Microweber 跨站脚本漏洞

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A cross-site scripting vulnerability exists in Microweber, which stems from an HTML...

Harbor fails to validate the user permissions when updating tag immutability policies

Impact Harbor fails to validate the user permissions when updating tag immutability policies - API call: PUT /projects/projectnameorid/immutabletagrules/immutableruleid By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated...

GHSA-8C6P-V837-77F6 Harbor fails to validate the user permissions when updating tag immutability policies

Impact Harbor fails to validate the user permissions when updating tag immutability policies - API call: PUT /projects/projectnameorid/immutabletagrules/immutableruleid By sending a request to update a tag immutability policy with an id that belongs to a project that the currently authenticated...

Harbor fails to validate the user permissions when updating tag retention policies

Impact Harbor fails to validate the user permissions when updating tag retention policies. API call: PUT /retentions/id By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modif...

GHSA-3637-V6VQ-XQQW Harbor fails to validate the user permissions when updating tag retention policies

Impact Harbor fails to validate the user permissions when updating tag retention policies. API call: PUT /retentions/id By sending a request to update a tag retention policy with an id that belongs to a project that the currently authenticated user doesn’t have access to, the attacker could modif...

XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection

Impact The tags document Main.Tags in XWiki didn't sanitize user inputs properly, allowing users with view rights on the document default in a public wiki or for authenticated users on private wikis to execute arbitrary Groovy, Python and Velocity code with programming rights. This allows bypassi...

PT-2022-20881 · Harbor · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions prior to 2.5.2 Description: The issue arises from Harbor's failure to validate user permissions when updating tag immutability policies. This can be exploited by sending a request to update a tag immutability policy with an id...

PT-2022-20883 · Harbor · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions prior to 2.5.2 Description: Harbor fails to validate user permissions when updating tag retention policies. By sending a request to update a tag retention policy with an id that belongs to a project that the currently...

PT-2022-33594 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.19.2 Description: The issue is related to the arm64 kernel and the Memory Tagging Extension MTE. It involves the page tag in page-flags not being reset properly. The actual impact and potential for attack hav...

walkerbooks.com.au Cross Site Scripting vulnerability OBB-2922918

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-31187

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-31187 due to insufficient neutralization of HTML tags in the global search context. The public advisory states that affected GLPI versions require upgrading to 10.0.3 to resolve the issue, or, if upgrading is not possible, dis...