SUSE CVE-2024-10458

A permission leak could have occurred from a trusted site to an untrusted site via embed or object elements. This vulnerability affects Firefox 132, Firefox ESR 128.4, Firefox ESR 115.17, Thunderbird 128.4, and Thunderbird 132...

The vulnerability in the web interface of the microprogramming software for Cisco Analog Telephone Adapter (ATA) series 190 allows a perpetrator to carry out cross-site scripting attacks.

The vulnerability of the web interface for managing microprogramming software in Cisco Analog Telephone Adapter ATA devices of the 190 series is related to the lack of measures taken to eliminate script-related HTML tags on the web page. Exploiting this vulnerability allows a malicious actor to...

The vulnerability of the wpDiscuz plugin of the WordPress content management system allows attackers to compromise data integrity.

The vulnerability of the wpDiscuz plugin in the WordPress content management system is related to the failure to remove scipt-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

CVE-2024-47882 OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the built-in "Something went wrong!" error page includes the exception message and exception traceback without escaping HTML tags, enabling injection into the page if an attacker can reliably produce an...

Apache Syncope: Stored XSS in Console and Enduser

When editing objects in the Syncope Console, incomplete HTML tags could be used to bypass HTML sanitization. This made it possible to inject stored XSS payloads which would trigger for other users during ordinary usage of the application. XSS payloads could also be injected in Syncope Enduser whe...

CVE-2024-44061

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFactory EU/UK VAT Manager for WooCommerce eu-vat-for-woocommerce.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through = 2.12.14...

CVE-2024-21274

...

protobuf: StackOverflow vulnerability in Protocol Buffers

A flaw was found in Protocol Buffers protobuf. This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion...

protobuf: StackOverflow vulnerability in Protocol Buffers

A flaw was found in Protocol Buffers protobuf. This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion...

protobuf: StackOverflow vulnerability in Protocol Buffers

A flaw was found in Protocol Buffers protobuf. This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion...

protobuf: StackOverflow vulnerability in Protocol Buffers

A flaw was found in Protocol Buffers protobuf. This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion...

CVE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...

CVE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...

CVE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse

Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that tag. This issue has been patched in the latest stable, beta and tests-passed version of Discourse. All users area are advised to upgrade. There are no known...

Cross Site Scripting(XSS)

github.com/alist-org/alist is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to inadequate input validation in the /i/:linkname endpoint, which fails to sanitize user-provided values, allowing malicious HTML tags to be executed in the application context...

Cross-site Scripting (XSS)

Overview tribalsystems/zenario is a Zenario is a web-based content management system for sites with one or many languages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Organizer tags field. An attacker can manipulate the output or behavior of the applicatio...

CVE-2024-45964

Zenario 9.7.61188 is vulnerable to Cross Site Scripting XSS in the Image library via the "Organizer tags" field...

PT-2024-31858 · Zenario · Zenario

Name of the Vulnerable Software and Affected Versions: Zenario version 9.7.61188 Description: The issue is a Cross Site Scripting XSS vulnerability in the Image library of Zenario, specifically via the Organizer tags field. This allows for potential malicious script execution. Recommendations: Fo...

Zenario CMS 安全漏洞

Zenario CMS is a Zenario open source application . Provides a Web-based content management system . A cross-site scripting vulnerability exists in Zenario CMS version 9.7.61188, which stems from the lack of effective filtering and escaping of user-supplied data in the "Organizer tags" field and c...

CVE-2024-45964

CVE-2024-45964 affects Zenario CMS version 9.7.61188. The vulnerability is a Cross-Site Scripting (XSS) in the Image library triggered via the Organizer tags field, arising from lack of proper filtering/escaping of user-supplied data. Impact details are limited in the provided documents, but mult...