CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)

Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page...

CVE-2024-21686

This High severity Stored XSS vulnerability was introduced in versions 7.13 of Confluence Data Center and Server. This Stored XSS vulnerability, with a CVSS Score of 7.3, allows an authenticated attacker to execute arbitrary HTML or JavaScript code on a victims browser which has high impact to...

PT-2024-19016

Name of the Vulnerable Software and Affected Versions Confluence Data Center and Server version 7.13 Confluence Data Center versions 8.8.0 through 8.8.1 Confluence Data Center versions 8.7.0 through 8.7.2 Confluence Data Center versions 8.6.0 through 8.6.2 Confluence Data Center versions 8.5.0...

CVE-2024-6306

CVE-2024-6306 is a duplicate of CVE-2024-32111. Connected sources detail a Path Traversal vulnerability in WordPress core, describing improper pathname handling that allowed relative path traversal across multiple versions. The OSV/NVD entries specify affected versions up to WordPress 6.5.4 and i...

PT-2024-37527

Name of the Vulnerable Software and Affected Versions: WordPress Core versions up to 6.5.5 Description: The issue allows authenticated attackers with Contributor-level access and above to include arbitrary HTML files on sites running Windows due to a Directory Traversal vulnerability via the...

Cross site scripting in opencart

This affects versions of the package opencart/opencart from 4.0.0.0. A reflected XSS issue was identified in the redirect parameter of customer account/login route. An attacker can inject arbitrary HTML and Javascript into the page response. As this vulnerability is present in the account...

Cross-Site Scripting

typo3/cms is vulnerable to Cross-Site Scripting. The vulnerability is due to improper sanitization of user input in the CSS styled content component, which allows an authenticated users to inject arbitrary HTML or JavaScript...

Cross-site Scripting (XSS)

typo3/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper encoding of editor input in the search result view, allowing authenticated editors to inject arbitrary HTML...

TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend

Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML...

GHSA-6FC6-CJ2J-H22X TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend

Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML...

PT-2024-40095

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned Description: The issue arises from the failure to properly encode user input, making several backend components susceptible to Cross-Site Scripting. This allows authenticated editors to inject...

Cross-Site Scripting (XSS)

silverstripe/framework is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of parameter sanitization, allowing the injection of arbitrary HTML through crafted URLs...

GHSA-M8V7-X398-PXRF Silverstripe XSS in CMS Edit Page

Due to a lack of parameter sanitisation a carefully crafted URL could be used to inject arbitrary HTML into the CMS Edit page. An attacker could create a URL and share it with a site administrator to perform an attack...

CVE-2024-34707

Nautobot is a Network Source of Truth and Network Automation Platform. A Nautobot user with admin privileges can modify the "BANNERTOP", "BANNERBOTTOM", and "BANNERLOGIN" configuration settings via the "/admin/constance/config/" endpoint. Normally these settings are used to provide custom banner...

CVE-2024-34707

CVE-2024-34707 affects Nautobot where an admin user can modify BANNER_TOP, BANNER_BOTTOM, and BANNER_LOGIN via the /admin/constance/config/ endpoint, enabling insertion of arbitrary HTML and potentially stored XSS across Nautobot pages. Multiple connected sources confirm this risk and describe th...

Dolibarr Application Home Page has HTML injection vulnerability

Summary Observed a HTML Injection vulnerbaility in the Home page of Dolibarr Application. This vulnerability allows an attacker to inject arbitrary HTML tags and manipulate the rendered content in the application's response. Specifically, I was able to successfully inject a new HTML tag into the...

CVE-2024-25690

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...

CVE-2024-25690

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...

CVE-2024-25690 HTML injection in ArcGIS Web AppBuilder

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...

CVE-2024-25690

CVE-2024-25690 describes an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below. An unauthenticated remote attacker could craft a link that, when clicked by a victim, renders arbitrary HTML in the browser. The description notes a network attack with user interaction req...