14270 matches found
PT-2023-19575 · Unknown · Rbs Image Gallery
Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery plugin versions 3.2.11 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Rbs Image Gallery plugin, specifically in the RoboSoft Photo Gallery, Images, Slider components. This issue can be exploited...
Collabora CODE / Collabora Online < 6.4.27, 21.x < 21.11.9, 22.x < 22.05.13 XSS Vulnerability
Collabora CODE Collabora Online Development Edition and Collabora Online are prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
CVE-2023-2528 Contact Form by Supsystic <= 1.7.24 - Cross-Site Request Forgery via AJAX action
The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.24. This is due to missing or incorrect nonce validation on the AJAX action handler. This makes it possible for unauthenticated attackers to execute AJAX actions vi...
webkitgtk: Same Origin Policy bypass issue
A logic issue was found in WebKitGTK and WPE WebKit. This flaw allows a remote attacker to process unexpected cross-origin attacks...
Cross-Site Scripting (XSS)
pimcore/pimcore is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of user input sanitization in the Name field of the WebsiteSetting.php , which allows an attacker to inject arbitrary JavaScript code into a victim's browser, potentially leading to the theft of user...
Cross site scripting
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account...
CVE-2023-31145 Reflected XSS vulnerability in CollaboraOnline
Collabora Online is a collaborative online office suite based on LibreOffice technology. This vulnerability report describes a reflected XSS vulnerability with full CSP bypass in Nextcloud installations using the recommended bundle. The vulnerability can be exploited to perform a trivial account...
CVE-2023-28522
IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585...
PT-2023-21775 · Ibm · Ibm Api Connect
Name of the Vulnerable Software and Affected Versions: IBM API Connect V10 Description: The issue allows an authenticated user to perform actions that they should not have access to. Recommendations: For IBM API Connect V10, at the moment, there is no information about a newer version that contai...
IBM API Connect 安全漏洞
IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from International Business Machines IBM. The product supports creating, running, managing, and securing APIs, microservices, and more. A security vulnerability exists in IBM API Connect version V10 that...
AZL-79046 CVE-2023-24539 affecting package golang 1.25.7-1
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
DEBIAN-CVE-2023-24540
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution...
AZL-37307 CVE-2023-24539 affecting package golang for versions less than 1.21.6-1
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
DEBIAN-CVE-2023-24539
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
AZL-37362 CVE-2023-24539 affecting package golang for versions less than 1.21.6-1
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
CVE-2023-24539
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
UBUNTU-CVE-2023-24539
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
CVE-2023-24539 Improper sanitization of CSS values in html/template
Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...
SUSE SLES15 Security Update : go1.20 (SUSE-SU-2023:2105-2)
The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2105-2 advisory. Update to 1.20.4 bnc1206346: - CVE-2023-24539: Fixed an improper sanitization of CSS values boo1211029. - CVE-2023-24540: Fixed an improper...