CVE-2022-27858

CSV Injection vulnerability in Activity Log Team Activity Log = 2.8.3 on WordPress...

Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release 18.0.1. The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality...

GHSA-W9MF-83W3-FV49 Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles

A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release 18.0.1. The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the default roles functionality...

CVE-2022-37339

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

CVE-2022-37339

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

Cross site scripting

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

CVE-2022-37339 WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

CVE-2022-37339 WordPress Meet My Team plugin <= 2.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

CVE-2022-37339

CVE-2022-37339 affects the WordPress Meet My Team plugin (versions ≤ 2.0.5). The vulnerability is an Authenticated Stored Cross-Site Scripting (XSS) flaw in Fullworks Meet My Team, caused by insufficient sanitization/escaping of inputs. A user with Contributor+ privileges can inject script that m...

CVE-2022-37339: Improper Neutralization of Input During Web Page Generation

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in Fullworks Meet My Team plugin = 2.0.5 at WordPress...

PT-2022-23935 · Fullworks · Fullworks Meet My Team Plugin

Name of the Vulnerable Software and Affected Versions: Fullworks Meet My Team plugin version 2.0.5 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with contributor or higher privileges can inject maliciou...

WordPress plugin Fullworks Meet My Team 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

CVE-2022-39197

An XSS Cross Site Scripting vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the...

Jenkins vulnerable to stored cross site scripting in the I:helpIcon component

Jenkins 2.367 through 2.369 both inclusive does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to control tooltips for this component. As of publication,...

HelpSystems Cobalt Strike 跨站脚本漏洞

HelpSystems Cobalt Strike is a penetration testing software from HelpSystems USA. HelpSystems Cobalt Strike 4.7 and prior versions suffer from a cross-site scripting vulnerability that stems from an XSS cross-site scripting vulnerability that allows a remote attacker to execute HTML on the Cobalt...

Malicious Package

Overview portableonboarding is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview duckduckgo-privacy-extension is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

GHSA-47M6-46MJ-P235 TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection

Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 5.7 Problem Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanis...

GHSA-P2G7-XWVR-RRW3 Helm Controller denial of service

Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK allows for specific data inputs to cause high memory consumption, which in some platforms could cause the controller to panic and stop processing reconciliations. Impact In a shared cluster multi-tenanc...

Pinecone - A WLAN Red Team Framework

Pinecone is a WLAN networks auditing tool, suitable for red team usage. It is extensible via modules, and it is designed to be run in Debian-based operating systems. Pinecone is specially oriented to be used with a Raspberry Pi, as a portable wireless auditing box. This tool is designed for...