The vulnerability of the deleteFiles() function in the web application of the Common Service Desktop of the ultrasonic diagnostic system from GE Healthcare allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the deleteFiles function in the Common Service Desktop web application of GE HealthCare is related to an incorrect limitation on the path to the restricted-access directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected...

CVE-2024-32978 Kaminari Insecure File Permissions Vulnerability

Kaminari is a paginator for web app frameworks and object relational mappings. A security vulnerability involving insecure file permissions has been identified in the Kaminari pagination library for Ruby on Rails, concerning insecure file permissions. This vulnerability is of moderate severity du...

CVE-2024-4765

Web application manifests were stored by using an insecure MD5 hash which allowed for a hash collision to overwrite another application's manifest. This could have been exploited to run arbitrary code in another application's context. This issue only affects Firefox for Android. Other versions of...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server ABAP Platform, which stems from a cross-site scripting XSS vulnerability due to failure to adequately encode user-controlled input...

CVE-2024-34074

CVE-2024-34074 affects Frappe, a full‑stack web framework. The vulnerability concerns the login page accepting a redirect argument, enabling redirects to untrusted external URLs and phishing risk. Affected versions before 14.74.0 and before 15.26.0 are fixed in 14.74.0 and 15.26.0, respectively. ...

PT-2024-25034 · Unknown · Pwasforfirefox

Name of the Vulnerable Software and Affected Versions: PWAsForFirefox versions prior to 2.12.0 Description: The issue arises from improper sanitization of web app properties, such as name, description, and shortcuts, allowing malicious web apps to inject additional lines into XDG Desktop Entries ...

CVE-2024-33905

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905: Improper Neutralization of Input During Web Page Generation

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

CVE-2024-33905

Telegram WebK versions prior to 2.0.0 (488) are vulnerable to a Cross-Site Scripting (XSS) flaw within the Mini Web App system. The root cause is improper handling of the postMessage web_app_open_link event type, which allows a crafted Mini Web App to execute malicious scripts. This vulnerability...

CVE-2024-33905

In Telegram WebK before 2.0.0 488, a crafted Mini Web App allows XSS via the postMessage webappopenlink event type...

PT-2024-25540 · Telegram · Telegram Web K

Name of the Vulnerable Software and Affected Versions: Telegram WebK versions prior to 2.0.0 488 Description: A Cross-Site Scripting XSS flaw in Telegram WebK allows attackers to gain full account access, potentially jeopardizing data and cryptowallets. The issue stems from the Mini App system an...

Microsoft Azure Web App Discovery And Assessment Service Installed (Windows)

Binary data microsoftazurewebappdiscoveryandassessmentservicewininstalled.nbin...

CVE-2024-25708

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2024-25708

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2024-25700 Persistent XSS in URL added to a shared map

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 11.1 and below that may allow a remote, authenticated attacker to create a crafted link that is stored in a web map link which when clicked could potentially execute arbitrary...

CVE-2024-25700

The CVE concerns Esri Portal for ArcGIS Enterprise Web App Builder (versions 11.1 and below). A stored Cross-site Scripting (XSS) condition can arise when an attacker with high privileges creates a crafted link stored in a web map; when clicked, it could execute arbitrary JavaScript in the victim...

CVE-2024-25708 Persistent XSS when creating new application using Web App Builder

There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Web App Builder versions 10.9.1 and below that may allow a remote, authenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s...

CVE-2024-25708

Esri Portal for ArcGIS Enterprise Web App Builder (versions 10.9.1 and below) is affected by a stored Cross-site Scripting vulnerability. The issue allows a remote, authenticated attacker to create a crafted link that, when clicked, could execute arbitrary JavaScript in the victim’s browser. The ...

PT-2024-21104 · Esri · Esri Portal For Arcgis Enterprise Web App Builder

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS Enterprise Web App Builder versions 10.8.1 through 10.9.1 Description: The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link which, when clicke...