11974 matches found
UBUNTU-CVE-2022-26387
When installing an add-on, Firefox verified the signature before prompting the user; but while the user was confirming the prompt, the underlying add-on file could have been modified and Firefox would not have noticed. This vulnerability affects Firefox 98, Firefox ESR 91.7, and Thunderbird 91.7...
MGASA-2022-0093 Updated firefox packages fix security vulnerabilities
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash CVE-2022-26381. When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification CVE-2022-26383. If an attacker coul...
Updated firefox packages fix security vulnerabilities
An attacker could have caused a use-after-free by forcing a text reflow in an SVG object leading to a potentially exploitable crash CVE-2022-26381. When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification CVE-2022-26383. If an attacker coul...
Cross-site Scripting (XSS) - Stored
Description pimcore datahub is vulnerable to Stored XSS in the Unique Indetifier of the function of "Add a new configuration" in Datahub. Whenever an admin user access data hub, a stored XSS will be triggered. Proof of Concept Step 1: Go to https://demo.pimcore.fun/admin/ and login. Step 2: Click...
Mozilla Firefox < 98.0
The version of Firefox installed on the remote macOS or Mac OS X host is prior to 98.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-10 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, the...
Security Vulnerabilities fixed in Firefox 98 — Mozilla
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript...
Mozilla Firefox < 98.0
The version of Firefox installed on the remote Windows host is prior to 98.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-10 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were abl...
Mozilla Firefox ESR < 91.7
The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 91.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2022-11 advisory. - If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts,...
Security Vulnerabilities fixed in Thunderbird 91.7 — Mozilla
When resizing a popup after requesting fullscreen access, the popup would not display the fullscreen notification. If an attacker could control the contents of an iframe sandboxed with allow-popups but not allow-scripts, they were able to craft a link that, when clicked, would lead to JavaScript...
CVE-2022-25394
Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php...
CVE-2022-25394
Medical Store Management System v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter under customer-add.php...
CVE-2022-25394
CVE-2022-25394 affects the Medical Store Management System v1.0. The vulnerability is a SQL injection in the cid parameter of customer-add.php, with CVSS-3.1 base score 9.8 (CRITICAL) and high impact on confidentiality, integrity, and availability. The attack vector is network and requires no pri...
Cross-site Scripting in Cipi
Cipi 3.1.15 allows Add Server stored cross-site scripting via the /api/servers name field...
GHSA-VPMW-77VM-4MJG Cross-site Scripting in Cipi
Cipi 3.1.15 allows Add Server stored cross-site scripting via the /api/servers name field...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field...
Liferay Portal 安全漏洞
Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, and so on. A security vulnerability exists in Liferay Portal...
CVE-2022-26332
Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field...
Cross site scripting
Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field...
CVE-2022-26332
CVE-2022-26332 affects Cipi 3.1.15 and enables stored XSS in the /api/servers name field. Multiple sources (NVD entry, Red Hat advisory, Veracode/GHSA, OSV, GITLAB file) confirm a stored XSS condition arising from unsafely accepted input for adding a server, enabling injection of arbitrary JavaSc...