95 matches found
NetBox 安全漏洞
NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A cross-site scripting vulnerability exists in NetBox v4.0.3, which stems from the lack of effective filtering and escaping of user-supplied data in t...
CVE-2024-22277
VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks...
PT-2024-7824 · Esri · Esri Portal For Arcgis
Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 11.0 and below Description: The issue is related to an HTML injection vulnerability that may allow a remote, authenticated attacker to create a crafted link which, when clicked, could render arbitrary HTML in t...
CVE-2023-48837
Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code...
CVE-2023-46595
Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 b570 or above, A32.50 b390 or above...
PT-2023-21340 · Liveaction · Liveaction Livesp
Name of the Vulnerable Software and Affected Versions: LiveAction LiveSP version 21.1.2 Description: A stored HTML injection issue allows attackers to execute arbitrary code via a crafted payload. Recommendations: For LiveAction LiveSP version 21.1.2, update to a version that fixes this issue to...
Easy!Appointments 代码注入漏洞
Easy!Appointments is a web-based appointment and schedule management system. A code injection vulnerability exists in versions prior to Easy!Appointments 1.5.0, which originates from an HTML injection on the /index.php/backend/settings page...
Improper Neutralization of Equivalent Special Elements
Overview Affected versions of this package are vulnerable to Improper Neutralization of Equivalent Special Elements due to improper user input validation, which allows HTML injection in the forms/Address page fields. Remediation Upgrade BTCPayServer.Client to version 1.7.3 or higher. References -...
PT-2022-24288 · Esri · Esri Portal For Arcgis
Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.9.1 and below Description: The issue is a reflected HTML injection that may allow a remote, unauthenticated attacker to create a crafted link. When clicked, this link could render arbitrary HTML in the...
SAP BusinessObjects Business Intelligence Platform Cross-Site Scripting Vulnerability
SAP BusinessObjects Business Intelligence Platform is a complete business analytics platform from SAP. The platform combines market-leading SAP data integration products, data management products, and business intelligence BI products to eliminate system integration challenges and deploy...
PT-2022-24345 · Cuppacms · Cuppacms
Name of the Vulnerable Software and Affected Versions: Cuppa CMS version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function at the "/table manager/view/cu user groups" API endpoin...
Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability
Adobe Flash Player contains a XSS vulnerability that allows remote attackers to inject web script or HTML...
Business-Dna Solution GmbH TopEase 跨站脚本漏洞
Business-Dna Solution GmbH TopEase is a "Transformational Risk" solution from Business-Dna Solution GmbH, Switzerland. It is used to manage complex projects and initiatives comprehensively, simply, quickly and securely. A cross-site scripting vulnerability exists in Business-Dna Solution GmbH...
Liferay Portal 跨站脚本漏洞
Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB and JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay Portal has a cross-site scripting vulnerability that can ...
Pi-hole 跨站脚本漏洞
Pi-hole is a multi-platform, network-wide ad-blocking tool. A cross-site scripting vulnerability exists in Pi-hole 5.0, 5.1, 5.1.1. The vulnerability stems from insufficient validation of user-supplied data. An attacker can exploit this vulnerability to inject arbitrary web script or HTML via the...
CVE-2020-25138
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via /alertcheck/action=deletealertchecker/alerttestid=...
CVE-2019-14758
An issue was discovered in KaiOS 2.5 and 2.5.1. The pre-installed File Manager application is vulnerable to HTML and JavaScript injection attacks. An attacker can send a file via email to the victim that will inject HTML into the File Manager application assuming the victim chooses to download th...
CVE-2020-14094
In Xiaomi router R3600, ROM version1.0.20, the connection service can be injected through the web interface, resulting in stack overflow or remote code execution...