Vulnerability of the software component /admin/conferences/get-all-status/ of TrueConf Server, which allows a hacker to perform cross-site scripting attacks

The vulnerability of the TrueConf Server software’s /admin/conferences/get-all-status/ component is related to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Cross site scripting

A vulnerability has been found in TrueConf Server 4.3.7 and classified as problematic. This vulnerability affects unknown code of the file /admin/conferences/get-all-status/. The manipulation of the argument keys leads to basic cross site scripting Reflected. The attack can be initiated remotely...

PT-2022-3299 · Trueconf · Trueconf Server

Name of the Vulnerable Software and Affected Versions: TrueConf Server version 4.3.7 Description: A vulnerability has been found in the /admin/conferences/get-all-status/ component of TrueConf Server, related to the failure to neutralize script-related HTML tags on a web page. The manipulation of...

TrueConf Server 跨站脚本漏洞

TrueConf Server is a self-hosted and secure video collaboration platform from the Russian company TrueConf. version 4.3.7 of TrueConf Server is vulnerable to a cross-site scripting vulnerability that originates from unknown code in the file /admin/conferences/get-all-status/, with the parameter...

GSD-2022-1003527 sfc: fix considering that all channels have TX queues

sfc: fix considering that all channels have TX queues This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.122 by commit...

Request a Quote <= 2.3.7 - CSV Injection

The plugin does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it On a page with a Quote Request form, upload the following CSV as an attachment: "First Name","Last...

Request a Quote <= 2.3.7 - CSV Injection

The plugin does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it PoC On a page with a Quote Request form, upload the following CSV as an attachment: "First Name","Last...

all-inklusive-umzug.de Cross Site Scripting vulnerability OBB-2688120

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-1977

The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks...

Upgraded Q -> M from 439 [1656339117398]

Judge has assessed an item in Issue 439 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

Upgraded Q -> M from 310 [1656347065145]

Judge has assessed an item in Issue 310 as Medium risk. The relevant finding follows: --- The text was updated successfully, but these errors were encountered: All reactions...

CVE-2022-21231

All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. Note: This vulnerability derives from an incomplete fix of CVE-2020-7715...

Malicious Package

Overview workspace-hoist-all is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Code injection

The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function...

Malicious code in test-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 748df8f06d1c1132320f9757b1361786793823e3dc2881ff8e6d6f8f33ac4606 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in all-of-them (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5760ca8f2a767c42d3ebdd58fb3b83f3f14b967be3c92ca3e98b3ba819b0b0aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nylas-mail-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5cc8ea198e81b0fc8307cbea75e5735d219ac373362c7748102cb514207959d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4989 Malicious code in nylas-mail-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5cc8ea198e81b0fc8307cbea75e5735d219ac373362c7748102cb514207959d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-agnitas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01b86b01a6021de948f8cc77186f640e5065625b57b69518f58e7df518fbe7c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in lx-cockpit-components-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87f911bdccde93661ec10bace02fa2c48d01a185ea3feaa9b23d92769647cb96 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...