2583 matches found
PT-2023-7549 · Asus · Asus Rt-Ax88U
Name of the Vulnerable Software and Affected Versions: ASUS RT-AX88U versions 3.0.0.4.388.23110 and prior Description: A stored cross-site scripting XSS issue was discovered within the Custom User Icons functionality. After a remote attacker logs in to the device with regular user privilege, they...
PT-2023-25596 · WordPress · Teachpress
Name of the Vulnerable Software and Affected Versions: teachPress plugin versions = 9.0.2 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading...
CVE-2023-38057 XSS stored in survey answers
An improper input validation vulnerability in OTRS Survey modules allows any attacker with a link to a valid and unanswered survey request to inject javascript code in free text answers. This allows a cross site scripting attack while reading the replies as authenticated agent. This issue affects...
PenTales: Testing Security Health for a Healthcare Company
At Rapid7 we love a good pen test story. So often they show the cleverness, skill, resilience, and dedication to our customer’s security that can only come from actively trying to break it! In this series, we’re going to share some of our favorite tales from the pen test desk and hopefully...
Zero-Day Attacks Exploited Critical Vulnerability in Citrix ADC and Gateway
Citrix is alerting users of a critical security flaw in NetScaler Application Delivery Controller ADC and Gateway that it said is being actively exploited in the wild. Tracked as CVE-2023-3519 CVSS score: 9.8, the issue relates to a case of code injection that could result in unauthenticated remo...
CVE-2023-33231
XSS attack was possible in DPA 2023.2 due to insufficient input validation...
Input validation
XSS attack was possible in DPA 2023.2 due to insufficient input validation...
CVE-2023-33231
CVE-2023-33231 applies to SolarWinds Database Performance Analyzer 2023.2, where XSS is caused by insufficient input validation in the web UI. The issue is tracked across multiple feeds; CVSS 3.1 base score 6.1 (MEDIUM), attack vector Network, user interaction Required, scope Changed. Connected a...
CVE-2023-33231 XSS in SolarWinds Database Performance Analyzer 2023.2
XSS attack was possible in DPA 2023.2 due to insufficient input validation...
CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....
CVE-2023-37272 XSS vulnerability in JOC Cockpit branch 1.13
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1....
CVE-2021-42083
An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC go to the alert manager open the ITSM tab add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss ' whitespaces are tab characters click add click apply create a test alert The tes...
Cross site scripting
Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Users with the backend.managebranding permission can upload SVGs as the application logo. Prior to version 1.2.3, SVG uploads were not sanitized, which could have allowed a stored cross-site scripting...
PT-2023-25767 · Travianz · Travianz
Name of the Vulnerable Software and Affected Versions: TravianZ versions 8.3.4 and earlier Description: The issue allows for XSS attacks through various means, including the Alliance tag/name, the statistics page, the link preferences, the Admin Logs, or the COOKUSR cookie. Recommendations: For...
Cross site scripting
A vulnerability in the ArubaOS web-based management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victim's browser in...
CVE-2023-20188
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authenticated, remote attacker to conduct a stored cross-site...
CVE-2023-20120
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Cisco Secure Email Gateway, formerly Cisco Email Security Appliance ESA; and Cisco Secure Web Appliance, formerly Cisco Web Security Appliance WSA, could allow a remote...
CVE-2023-20188
A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business 500 Series Stackable Managed Switches could allow an authenticated, remote attacker to conduct a stored cross-site...
sidrc.org Cross Site Scripting vulnerability OBB-3471697
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-35159 XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as:...