2554 matches found
CVE-2022-24896
Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...
PT-2022-16965
Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 13.7.99.239 Description The issue arises from improper authorization verification when displaying the content of tracker report renderer and chart widgets. This allows malicious users to retrieve the name of a tracker...
CVE-2022-24896: Missing Authorization
Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...
Malicious code in survey-widgets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2112bbae1e65790567a0ca80131bd2fef3b3ba74e669e0dcbc8f409d3291fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-6362 Malicious code in survey-widgets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2112bbae1e65790567a0ca80131bd2fef3b3ba74e669e0dcbc8f409d3291fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
GHSA-3X9X-VHQJ-CV27 Magento XML Injection vulnerability in the Widgets Update Layout
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...
Magento XML Injection vulnerability in the Widgets Update Layout
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...
GHSA-P746-QW73-QMMX Magento XML Injection vulnerability in the Widgets Module
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...
Magento XML Injection vulnerability in the Widgets Module
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...
Magento XML injection in the Widgets module
Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...
GHSA-MW95-GMW4-883P Magento XML injection in the Widgets module
Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...
Total.js CMS RCE Vulnerability
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...
GHSA-V287-9W3V-X5C5 Total.js CMS RCE Vulnerability
An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...
May 24, 2022âKB5014019 (OS Build 22000.708) Preview
None None...
PT-2022-37713
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...
PT-2022-37723
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...
Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS
The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping " document.getElementById"test".submit; The XSS will be...
@binary-com/binary-style (>=0.2.4, <=0.2.26), @dfeidao/widgets (>=4.6.201904011830, <=4.6.201904291719) +10 more potentially affected by CVE-2016-10744 via select2 (>=4.0.1, <=4.0.5)
select2 NPM version =4.0.1, =0.2.4, =4.6.201904011830, =0.1.0, =2.3.1, =0.11.28, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =1.0.1 Source cves: CVE-2016-10744 Source advisory: OSV:GHSA-RF66-HMQF-Q3FC...
Jenkins has Information Disclosure via Sidepanel Widget
The sidepanel widgets in the CLI command overview and help pages in Jenkins before 1.638 and LTS before 1.625.2 allow remote attackers to obtain sensitive information via a direct request to the pages...
Information Exposure
Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Information Exposure via the sidepanel widgets in the CLI command overview and help pages. An attacker can obtain sensitive information by making a direct request to...