WordPress Widget Settings Importer/Exporter plugin <= 1.5.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by WordFence in WordPress Widget Settings Importer/Exporter plugin versions = 1.5.3. Solution This plugin has been closed as of April 13, 2020 and is not available for download. Reason: Security Issue...

Update Rollup 3 for System Center 2012 R2 Operations Manager

Update Rollup 3 for System Center 2012 R2 Operations Manager Introduction This article describes the issues that are fixed in Update Rollup 3 for Microsoft System Center 2012 R2 Operations Manager. Additionally, this article contains the installation instructions for Update Rollup 3 for System...

CVE-2020-10976

GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...

Cross site request forgery (csrf)

GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...

CVE-2020-10976

GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...

CVE-2020-10976

CVE-2020-10976 affects GitLab EE/CE versions 8.17 through 12.9, with information leakage when querying the merge request widget. The issue is a server-side information disclosure vulnerability (network vector, no authentication) leading to partial confidentiality impact. It is addressed in GitLab...

CVE-2020-10976

Removed by vendor...

PT-2020-12461 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE/CE versions 8.17 to 12.9 Description: The issue concerns information leakage when querying a merge request widget. Recommendations: For GitLab EE/CE versions 8.17 to 12.9, update to a version that contains a fix for this issue to...

CVE-2020-10976: Exposure of Sensitive Information to an Unauthorized Actor

GitLab EE/CE 8.17 to 12.9 is vulnerable to information leakage when querying a merge request widget...

Fedora 30 : ckeditor (2020-261449d821)

CKEditor 4.14 Security Updates: - CVE-2020-9281 Fixed XSS vulnerability in the HTML data processor reported by Micha Bentkowski of Securitum. Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: i switch CKEditor to source mode, then ii paste a specially...

Mail.ru: relap.io CSRF bypass on adding domain to use relap widgets

The lack of CSRF protection in API endpoint in relap.io allowed to force user to add domain to the widget...

CVE-2020-9008

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

CVE-2020-9008

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

Cross site scripting

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

CVE-2020-9008

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

CVE-2020-9008

CVE-2020-9008 : Stored XSS in Blackboard Learn/PeopleTool v9.1 via the Tile widget in the People Tool profile editor. Root cause described in CNVD as lack of proper validation of client-side data. Impact per sources: ability to execute client-side code. No explicit remediation details are provide...

CVE-2020-9008: Improper Neutralization of Input During Web Page Generation

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

PT-2020-20427

Name of the Vulnerable Software and Affected Versions Blackboard Learn/PeopleTool version 9.1 Description A stored Cross-site scripting XSS issue allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor. This could potentially affect a significant number o...

CVE-2020-9382

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget as defined by this extension via MediaWiki's widget: parser function...

CVE-2020-9382

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget as defined by this extension via MediaWiki's widget: parser function...