PT-2022-19200 · Apache · Apache Jspwiki

Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions prior to 2.11.3 Description: A carefully crafted request could trigger a vulnerability on Apache JSPWiki, allowing an attacker to execute javascript in the victim's browser and obtain sensitive information. The issue c...

JFrog Artifactory Cross-Site Scripting Vulnerability

JFrog Artifactory is an open source general-purpose Artifact repository manager from Israel-based JFrog that supports clustering and high-availability Docker registries and provides an end-to-end solution for tracking artifact automation from development to production.JFrog Artifactory suffers fr...

PT-2022-12372 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory versions prior to 7.29.8 JFrog Artifactory versions prior to 6.23.38 Description: The issue is related to Reflected Cross-Site Scripting XSS through one of the XHR parameters in the "Users REST API endpoint". Recommendations...

CVE-2021-45721: Improper Neutralization of Input During Web Page Generation

JFrog Artifactory prior to version 7.29.8 and 6.23.38 is vulnerable to Reflected Cross-Site Scripting XSS through one of the XHR parameters in Users REST API endpoint. This issue affects: JFrog JFrog Artifactory JFrog Artifactory versions before 7.36.1 versions prior to 7.29.8; JFrog Artifactory...

silverstripe framework跨站脚本漏洞

silverstripe framework is a CMS website framework. silverstripe framework version 4.10.0 and prior versions contain a cross-site scripting vulnerability, which stems from the fact that tokens within the script can be added to the website content by an authenticated CMS user via XHR. An attacker...

Stored XSS via HTML fields in SilverStripe Framework

SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

GHSA-JX34-GQQQ-R6GM Stored XSS via HTML fields in SilverStripe Framework

SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

CVE-2022-28803

CVE-2022-28803 concerns the SilverStripe Framework (through 2022-04-07) where a Stored XSS vulnerability can occur in javascript link tags added via XMLHttpRequest (XHR). The issue is triggered by content added to the page that includes a javascript: link tag, enabling script execution in the con...

CVE-2022-25238

CVE-2022-25238 affects the SilverStripe Framework up to version 4.10.0, where an authenticated CMS user can inject tokens into script content via XHR, enabling XSS when the cwp-core module is not installed and sanitise_server_side contig is not true. The issue is documented across multiple source...

CVE-2022-25238

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

PT-2022-17171

Name of the Vulnerable Software and Affected Versions Silverstripe silverstripe/framework versions 4.10.0 through 4.10.8 Silverstripe silverstripe/framework versions prior to 4.10.9 is not mentioned, however since 4.10.8 is the last version mentioned as vulnerable, we can assume that versions pri...

CVE-2022-28803: Stored XSS in link tags added via XHR

More info at https://www.silverstripe.org/download/security-releases/cve-2022-28803...

Malicious code in mrg-nano-xhr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5584946fb8e4619d73092f2d29472ca79e307d08f72e7036028a4d1d4836dd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4711 Malicious code in mrg-nano-xhr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5584946fb8e4619d73092f2d29472ca79e307d08f72e7036028a4d1d4836dd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

GHSA-CMV8-6362-R5W9 Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API. The attacker...

Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

CVE-2022-29164

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

Hardcoded credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...

CVE-2022-29164 Privilege Escalation in argo-workflows

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. In affected versions an attacker can create a workflow which produces a HTML artifact containing an HTML file that contains a script which uses XHR calls to interact with the Argo Serv...