Cross site scripting

Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 for Movable Type 7 Series and versions prior to 3.9.1 for Movable Type 6 Series allows a remote unauthenticated attacker to inject an arbitrary script...

CVE-2022-38972

CVE-2022-38972 is a cross-site scripting vulnerability in the Movable Type plugin A-Form . Affected versions are: prior to 4.1.1 for Movable Type 7 Series, and prior to 3.9.1 for Movable Type 6 Series. The flaw lets a remote, unauthenticated attacker inject arbitrary scripts into users’ browsers....

CVE-2022-38972

Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 for Movable Type 7 Series and versions prior to 3.9.1 for Movable Type 6 Series allows a remote unauthenticated attacker to inject an arbitrary script...

PT-2022-24629 · Movable Type · A-Form

Name of the Vulnerable Software and Affected Versions: Movable Type plugin A-Form versions prior to 4.1.1 for Movable Type 7 Series Movable Type plugin A-Form versions prior to 3.9.1 for Movable Type 6 Series Description: A cross-site scripting issue allows a remote unauthenticated attacker to...

Six Apart Movable Type 跨站脚本漏洞

Six Apart Movable Type MT is a blogging system from Six Apart USA. The system includes features such as multiple users, comments, quotes, and topics. A security vulnerability exists in the Six Apart Movable Type plugin A-Form, which originates from the fact that it allows remote, unauthenticated...

antiquespisos.com Cross Site Scripting vulnerability OBB-2909804

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

aschau-a-inn.de Cross Site Scripting vulnerability OBB-2909173

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-40317

OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...

Cross site scripting

OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...

CVE-2022-40317

OpenKM 6.3.11 allows stored XSS related to the javascript substring in an A element...

CVE-2022-28741

aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion LFI vulnerability that occurs due to missing input validation in v5.x...

Input validation

aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion LFI vulnerability that occurs due to missing input validation in v5.x...

CVE-2022-28741

aEnrich a+HRD 5.x Learning Management Key Performance Indicator System has a local file inclusion LFI vulnerability that occurs due to missing input validation in v5.x...

Transacting in Person with Strangers from the Internet

Communities like Craigslist, OfferUp, Facebook Marketplace and others are great for finding low- or no-cost stuff that one can pick up directly from a nearby seller, and for getting rid of useful things that dont deserve to end up in a landfill. But when dealing with strangers from the Internet,...

Movable Type plugin A-Form vulnerable to cross-site scripting

Overview Movable Type plugin A-Form provided by ARK-Web co., ltd. contains a cross-site scripting vulnerability CWE-79. hibiki moriyama of STNet, Incorporated reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact ...

JVN#48120704: Movable Type plugin A-Form vulnerable to cross-site scripting

Movable Type plugin A-Form provided by ARK-Web co., ltd. contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user who accessed the site using the product. Solution Update the Software Update A-Form to the latest version...

Windows shellcode stage, Bind TCP Stager (No NX or Win7)

Custom shellcode stage. Listen for a connection No NX Module Options msf use payload/windows/custom/bindnonxtcp msf payloadbindnonxtcp show actions ...actions... msf payloadbindnonxtcp set ACTION msf payloadbindnonxtcp show options ...show and set options... msf payloadbindnonxtcp run This module...

Tenable SecurityCenter 5.19.x / 5.20.x / 5.21.0 Moment.js Denial of Service (TNS-2022-18) (deprecated)

This plugin has been deprecated and replaced with plugin ID 163634. %NASLMINLEVEL 80900 C Tenable, Inc. @DEPRECATED@ Disabled on 2022/09/22. Deprecated by securitycenter5220tns202207.nasl. include'compat.inc'; if description scriptid164841; scriptversion"1.5";...

CVE-2022-36065 GrowthBook account creation and file upload vulnerability in self-hosted configurations

GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can register new accounts and upload files to arbitrary directories within the container. If the attacker uploads a Python script to the righ...

CVE-2022-36065

GrowthBook (self-hosted) prior to 2022-08-29 is affected by an account creation and arbitrary file-upload vulnerability that can lead to remote code execution if a Python script is uploaded to an arbitrary directory inside the container. Exploitation requires all of: self-hosted deployment (Growt...