PT-2023-21997 · Wagtail · Wagtail

Name of the Vulnerable Software and Affected Versions: Wagtail versions 1.5 through 4.1.3 Wagtail versions 1.5 through 4.2.1 Description: A stored cross-site scripting XSS vulnerability exists on ModelAdmin views within the Wagtail admin interface. A user with a limited-permission editor account...

Malicious code in cms-ui-views (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 636cafa99151c70813b92018c04a866bf889ce49006e1f029efa7f5facd17639 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-196 Malicious code in cms-ui-views (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 636cafa99151c70813b92018c04a866bf889ce49006e1f029efa7f5facd17639 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview cms-ui-views is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Atlassian Jira < 6.0.5 Multiple Vulnerabilities

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 6.0.5. It is, therefore, affected by multiple vulnerabilities: - A directory traversal in the Importers Plugin which permits remote attackers to create arbitrary files...

JVN#19872280: Multiple vulnerabilities in PostgreSQL extension module pg_ivm

pgivm provided by IVM Development Group is a PostgreSQL extension module that provides incremental view maintenance functionality of materialized views. pgivm contains multiple vulnerabilities listed below. Exposure of sensitive information to an unauthorized actor CWE-200 - CVE-2023-22847 An...

CVE-2022-4927: Use of Web Link to Untrusted Target with window.opener Access

A vulnerability was found in ualbertalib NEOSDiscovery 1.0.70 and classified as problematic. This issue affects some unknown processing of the file app/views/bookmarks/refworks.html.erb. The manipulation leads to use of web link to untrusted target with window.opener access. The attack may be...

Malicious Package

Overview eslint-plugin-yandex-morda-views is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable ...

CVE-2022-4761

The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4761

The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-4761

CVE-2022-4761 affects the WordPress plugin Post Views Count, version 3.0.2 and earlier. The vulnerability arises from not validating/escaping shortcode attributes before output, enabling Stored XSS when a crafted shortcode is embedded in a post and viewed by users with contributor roles or higher...

CVE-2022-4761 Post Views Count <= 3.0.2 - Contributor+ Stored XSS in Shortcode

The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

WordPress Plugin Post Views Count 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-15432

Name of the Vulnerable Software and Affected Versions Post Views Count WordPress plugin versions 3.0.2 and earlier Description The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin not validating and escaping some of its...

CVE-2022-4761: Undefined Security Weakness

The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2022-48327: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: 1 dataInicial, 2 dataFinal, 3 tipocliente, 4 format, 5 precoInicial, 6 precoFinal, 7 estoqueInicial, 8 estoqueFinal, 9 deid, 10 ateid, 11 clientesid, 12...

SUSE CVE-2006-2779

Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via 1 nested tags in a select tag, 2 a DOMNodeRemoved mutation event, 3 "Content-implemented tree views," 4 BoxObjects, 5 the XBL implementation, 6 an ifram...

SUSE CVE-2010-2536

Multiple cross-site scripting XSS vulnerabilities in rekonq 0.5 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 a URL associated with a nonexistent domain name, related to webpage.cpp, aka a "universal XSS" issue; 2 unspecified vectors related to webview.cpp; and t...

SUSE CVE-2011-2929

The template selection functionality in actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping...

SUSE CVE-2013-2214

status.cgi in Nagios 4.0 before 4.0 beta4 and 3.x before 3.5.1 does not properly restrict access to certain users that are a contact for a service, which allows remote authenticated users to obtain sensitive information about hostnames via the servicegroup 1 overview, 2 summary, or 3 grid style i...