CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

Design/Logic Flaw

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. For instance, the following URL execute an alter on the browser:...

CVE-2023-34203

CVE-2023-34203 affects Progress OpenEdge OEM (OpenEdge Management) and OEE (OpenEdge Explorer). A remote user who has any OEM or OEE role can perform a URL injection attack to change identity or role membership, enabling escalation to admin. Affected versions are: OpenEdge LTS before 11.7.16; Ope...

Progress OpenEdge 注入漏洞

Progress OpenEdge is an application. A security vulnerability exists in Progress OpenEdge LTS versions prior to 11.7.16, 12.x through 12.2.12, and 12.3.x through 12.6.x. The vulnerability stems from a URL injection attack that can be executed by a remote user to change identity or role membership...

CVE-2023-34203

In Progress OpenEdge OEM OpenEdge Management and OEE OpenEdge Explorer before 12.7, a remote user who has any OEM or OEE role could perform a URL injection attack to change identity or role membership, e.g., escalate to admin. This affects OpenEdge LTS before 11.7.16, 12.x before 12.2.12, and...

PT-2023-24734 · Progress · Openedge

Name of the Vulnerable Software and Affected Versions: OpenEdge versions prior to 12.7 OpenEdge LTS versions prior to 11.7.16 OpenEdge 12.x versions prior to 12.2.12 OpenEdge 12.3.x through 12.6.x Description: A remote user with any OEM or OEE role could perform a URL injection attack to change...

XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

GHSA-X234-MG7Q-M8G8 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template

Impact Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alertdocument.domain This vulnerability exists sin...

Server side request forgery (ssrf)

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests v...

CVE-2023-29291 Server Side Request Forgery (SSRF) in USPS carrier integration configuration

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. An admin-privilege authenticated attacker can force the application to make arbitrary requests v...

Cross-site Scripting (XSS)

com.liferay.client.extension.type.impl is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the IFrame-type remote apps in the library because it does not properly escape the URL fields, which allows an attacker to inject and execute malicious JavaScript through the remote app's...

Cross site scripting

Reflected Cross Site Scripting XSS in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly...

Wallpaper 安全漏洞

Wallpaper is a wallpaper application from Wallpaper Inc. A security vulnerability exists in Wallpaper version 12, which stems from a vulnerability that allows an attacker to force the application to load a malicious image URL and display it in the UI by injecting data, ultimately resulting in a...

Deserialization Of Untrusted Data

org.apache.inlong:manager-pojo is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists in multiple functions because an attacker is able to add whitespaces when saving a url, which allows bypassing the autoDeserialize option filtering, resulting in deserialization of...

CVE-2023-29506

XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10...

Code injection

XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10...

CVE-2023-29506

XWiki CVE-2023-29506 is a cross-site scripting vulnerability in XWiki Commons affecting authenticated endpoints. The issue arises from code that could be injected via the URL used by authenticated requests, leading to arbitrary JavaScript execution in the victim’s browser. Concrete details from c...

CVE-2023-29506 org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints

XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10...

CVE-2022-3695 Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.3.0.0, 9.2.0.4 and 8.3.0.27 allow a malicious URL to inject content into a dashboard when the CDE plugin is present...

Code injection

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables...