PT-2023-12345 · Ibm · Ibm Cloud Object System

Name of the Vulnerable Software and Affected Versions: IBM Cloud Object System version 3.15.8.97 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session. Th...

Telegram 安全漏洞

Telegram is an instant messaging mobile application. A security vulnerability exists in Telegram version v9.6.3, which stems from a vulnerability that allows an attacker to hide critical information on the User Interface by calling the function SFSafariViewController...

PT-2023-17999 · Hashicorp +1 · Hashicorp Vault +1

Name of the Vulnerable Software and Affected Versions: Hashicorp Vault versions prior to 1.11.11 Hashicorp Vault versions prior to 1.12.7 Hashicorp Vault versions prior to 1.13.3 Hashicorp Vault versions prior to 1.14.0 Description: The key-value v2 kv-v2 diff viewer in Vault allowed HTML injecti...

GHSA-5XQ9-H3J2-JXVC Cross Site Scripting (XSS) Vulnerability in Fetlife rollout-ui gem

Cross Site Scripting XSS Vulnerability in Fetlife rollout-ui version 0.5, allows attackers to execute arbitrary code via a crafted url to the delete a feature functionality...

Buffer overflow

A vulnerability has been discovered in Rocket.Chat, where editing messages can change the original timestamp, causing the UI to display messages in an incorrect order...

PT-2023-22947 · Sap · Sapui5

Name of the Vulnerable Software and Affected Versions: SAPUI5 versions SAP UI 750, SAP UI 754, SAP UI 755, SAP UI 756, SAP UI 757, UI 700 200 Description: The issue arises from improper neutralization of input in SAPUI5, allowing the injection of untrusted CSS through the sap.m.FormattedText SAPU...

PYSEC-2023-60

Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0...

CVE-2023-29247

CVE-2023-29247 corresponds to a stored XSS in Apache Airflow’s Task instance details page, affecting versions prior to 2.6.0. Several connected sources (NVD, OSV entries, CNVD, GHSA, CNVD) converge on: vulnerable component is the UI rendering of task instance details; root cause is improper handl...

CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...

eDEX-UI 访问控制错误漏洞

eDEX-UI is a full-screen, cross-platform terminal emulator and system monitor from the individual developer Gabriel Saillard in France. A security vulnerability exists in eDEX-UI version 2.2.8 and prior versions, which stems from vulnerability to cross-site web hijacking, where a malicious websit...

PT-2023-23012

Name of the Vulnerable Software and Affected Versions eDEX-UI versions 2.2.8 and prior Description eDEX-UI is a science fiction terminal emulator that is vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal...

PT-2023-12705 · Varta · Varta Storage

Name of the Vulnerable Software and Affected Versions: VARTA Storage products affected versions not specified Description: The issue concerns hard-coded credentials in the Web-UI of multiple VARTA Storage products, allowing an unauthorized attacker to gain administrative access to the Web-UI via...

PT-2023-2104 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the...

Jquery UI 1.13.1 in use which is vulnerable to CVE-2022-31160

Description Jquery UI 1.13.1 in use which is vulnerable to CVE-2022-31160 Proof of Concept 1 Go to https://demo.limesurvey.org/tmp/assets/15bf41ab/jquery-ui.min.js and note that jquery-ui 1.13.1 is in use. 2 Check...

SUSE CVE-2012-2827

Use-after-free vulnerability in the UI in Google Chrome before 20.0.1132.43 on Mac OS X allows attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

PT-2023-12688 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.1.2.1 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

Apache Airflow subject to Exposure of Sensitive Information

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

Code injection

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

PYSEC-2022-42981

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed for example when they were depending on past and previous instances of the task failed. This issue affects Apache Airflow prior to 2.3.1...

PT-2022-18717 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.3.1 Description: A vulnerability in the UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks that were not executed, such as when tasks were depending on pas...