ABB Cylon Aspect 3.08.02 PHP Session Fixation Vulnerability

ABB Cylon Aspect version 3.08.02 is vulnerable to session fixation, allowing an attacker to set a predefined PHPSESSID value. An attacker can leverage an unauthenticated reflected cross site scripting vulnerability in jsonProxy.php to inject a crafted request, forcing the victim to adopt a fixate...

CVE-2024-52942

Veritas Enterprise Vault is affected prior to 15.1 UPD882911. The HTMLView endpoint allows an authenticated attacker to inject data into HTTP requests, enabling reflected XSS when viewing archived content. Root cause: insufficient validation of user-supplied data in HTMLView. Impact: XSS could be...

CVE-2024-10184

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sw-kick-embed shortcode in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

K000141253: Python vulnerability CVE-2024-22195

Security Advisory Description Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting XSS. The Jinja...

CVE-2024-43370

gettext.js is a GNU gettext port for node and the browser. There is a cross-site scripting XSS injection if .po dictionary definition files are corrupted. This vulnerability has been patched in version 2.0.3. As a workaround, control the origin of the definition catalog to prevent the use of this...

gettext.js has a Cross-site Scripting injection

Impact Possible vulnerability to XSS injection if .po dictionary definition files is corrupted Patches Update gettext.js to 2.0.3 Workarounds Make sure you control the origin of the definition catalog to prevent the use of this flaw in the definition of plural forms...

XMB 1.9.12.06 Cross Site Scripting

Exploit Title: Persistent XSS in XMB 1.9.12.06 Date: 06/12/2024 Exploit Author: Chokri Hammedi Vendor Homepage: https://www.xmbforum2.com/ Software Link: https://www.xmbforum2.com/download/XMB-1.9.12.06.zip Version: 1.9.12.06 Tested on: Windows XP CVE: N/A Vulnerability Details A persistent store...

GHSA-Q73V-79X3-JV2W eZ Platform Admin UI Cross-site Scripting vulnerability

This security advisory fixes a severe vulnerability in the eZ Platform Admin UI, and we recommend that you install it as soon as possible. Parts of the Admin UI are vulnerable to XSS injection. All 2.x sites are at risk, and particularly those that allow user generated content. The update adds th...

PT-2024-40034 · Ez Systems · Ez Publish Legacy

Name of the Vulnerable Software and Affected Versions: eZ Publish Legacy affected versions not specified Description: The issue concerns a vulnerability in eZ Publish Legacy that could lead to XSS injection in certain configurations, particularly when all modules are disabled. This vulnerability...

RHEL 7 : ovirt-engine (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ovirt-engine: webadmin log out must logout all sessions CVE-2016-6338 - ovirt-engine: API exposes power...

Cross site scripting

Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure o...

ILIAS < 7.25, 8.x < 8.5 Multiple Vulnerabilities

ILIAS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ilias:ilias"; if description...

CVE-2023-45757 Apache bRPC: The builtin service rpcz page has an XSS attack vulnerability

Security vulnerability in Apache bRPC 1.6.0, download link: https://dist.apache.org/repos/dist/release/brpc/1.6.1/ 2. If you are using an old version of bRPC and hard to upgrade, you can apply this patch: https://github.com/apache/brpc/pull/2411 3. disable rpcz feature...

CVE-2023-34412

A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code XSS...

PrestaShop XSS injection through Validate::isCleanHTML method

Impact xss injection through isCleanHTML method Patches 1.7.8.10 8.0.5 8.1.1 Found by Aleksey Solovev Positive Technologies Workarounds References...

GHSA-XW2R-F8XV-C8XP PrestaShop XSS injection through Validate::isCleanHTML method

Impact xss injection through isCleanHTML method Patches 1.7.8.10 8.0.5 8.1.1 Found by Aleksey Solovev Positive Technologies Workarounds References...

CVE-2023-37061

Chamilo 1.11.x up to 1.11.20 allows users with an admin privilege account to insert XSS in the languages management section...

Cross site scripting

2FA is a Web app to manage Two-Factor Authentication 2FA accounts and generate their security codes. Cross site scripting XSS injection can be done via the account/service field. This was tested in docker-compose environment. This vulnerability has been patched in version 4.0.3...

GHSA-FH7R-996Q-GVCP Possible XSS injection through Validate::isCleanHTML method

Impact ValidateCore::isCleanHTML method of Prestashop misses hijickable events which can lead to XSS injection, allowed by the presence of pre-setup @keyframes methods. This XSS which hijacks HTML attributes will be triggered without any interaction of the visitor/administrator which makes it as...

CVE-2023-30838 PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the ValidateCore::isCleanHTML method of Prestashop misses hijackable events which can lead to cross-site scripting XSS injection, allowed by the presence of pre-setup @keyframes methods. This XSS, which...