CVE-2022-46968

CVE-2022-46968 is a stored XSS vulnerability in Revenue Collection System v1.0, exploitable via /index.php?page=help where a crafted payload injected into sent messages allows arbitrary web scripts/HTML. Affected: Revenue Collection System v1.0 (component: /index.php?page=help). Impact per source...

CVE-2022-48013

Opencats v0.9.7 contains a stored XSS vulnerability in the calendar component ( /opencats/index.php?m=calendar ). The underlying issue allows injecting payloads into the Description or Title fields, enabling execution of arbitrary web scripts or HTML by an attacker who can supply crafted input. C...

CVE-2022-48007

A stored cross-site scripting XSS vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent...

fnr.de Cross Site Scripting vulnerability OBB-3169108

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mozilla: Arbitrary file read from GTK drag and drop on Linux

The Mozilla Foundation Security Advisory describes this flaw as: Due to the Firefox GTK wrapper code's use of text/plain for drag data and GTK treating all text/plain MIMEs containing file URLs as being dragged a website could arbitrarily read a file via a call to DataTransfer.setData...

CVE-2022-47073

CVE-2022-47073 describes a cross-site scripting (XSS) vulnerability in Small CRM v3.0, specifically on the Create Ticket page where a crafted payload injected into the Subject parameter can execute arbitrary web scripts/HTML. The issue arises from improper handling of the Subject input, enabling ...

Remote Code Execution(RCE)

firefox is vulnerable to Remote Code ExecutionRCE. A duplicate SystemPrincipal object could be created when parsing a non-system html document via DOMParser::ParseFromSafeString leading to web security bypass, which allows an attacker to upload and execute malicious code on the system under attac...

kbbs.ktcar.co.kr Cross Site Scripting vulnerability OBB-3167717

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Arbitrary File Read

firefox is vulnerable to arbitrary file read. A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to an...

CVE-2023-0446

CVE-2023-0446 affects the WordPress plugin My YouTube Channel. The vulnerability is a Stored Cross-Site Scripting flaw in the plugin’s settings parameters caused by insufficient input sanitization and output escaping, impacting versions up to 3.0.12.1 (or 3.0.12 as cited by some sources). Exploit...

Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 9.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

USN-5816-1: Firefox vulnerabilities

Niklas Baumstark discovered that a compromised web child process of Firefox could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. An attacker could potentially exploits this to obtain sensitive information. CVE-2023-23597 Tom...

0564.ua Cross Site Scripting vulnerability OBB-3162942

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross site scripting

Book Store Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in /bsmsci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the writer parameter...

CVE-2022-41441

CVE-2022-41441 affects ReQlogic v11.3. The issue is a cross-site scripting (XSS) vulnerability exploitable via crafted payloads in the POBatch and WaitDuration parameters, allowing execution of arbitrary web scripts in the victim’s browser. Documented impact includes script execution with potenti...

xcash 1.5 Insecure Settings

==================================================================================================================================== | Title : xcash V1.5 Insecure Settings Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 103.064-bit | |...

CVE-2023-23604

A duplicate SystemPrincipal object could be created when parsing a non-system html document via DOMParser::ParseFromSafeString. This could have lead to bypassing web security checks. This vulnerability affects Firefox 109...

CVE-2023-23597

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefo...

UBUNTU-CVE-2023-23597

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefo...

Mozilla Firefox < 109.0

The version of Firefox installed on the remote Windows host is prior to 109.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2023-01 advisory. - Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 108. Some of these bugs...