Persistent Cross Site Scripting - LayoutEditor Module - Settings

Description The application uses Purifier to avoid the Cross Site Scripting attack. However, On LayoutEditor module from Settings, the type of fieldModel-label parameter is "Text" but it is not validated and it's used directly without any encoding or validation on LayoutEditor/EditField.tpl. It...

Dropwizard-Validation Injection Vulnerability

Dropwizard is a Java framework for the development of easy to operate , high-performance RESTful web services . An injection vulnerability exists in Dropwizard-Validation versions prior to 1.3.19 and prior to 2.0.2. The vulnerability arises when a web system or product lacks proper validation of...