Squidex cross-site scripting vulnerabilities

squidex is a Headless CMS and content management center. A cross-site scripting vulnerability exists in Squidex versions prior to 7.9.0, which stems from the presence of an incomplete blacklist in the SVG check, and can be exploited by an attacker to conduct a cross-site scripting attack via the...

CVE-2023-49276

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

Cross site scripting

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276

CVE-2023-49276 affects Uptime Kuma (open-source self-hosted monitoring tool). The vulnerability arises from an attribute injection in the Google Analytics element due to unsanitized template usage, enabling Cross-Site Scripting (XSS) when a custom Google Analytics ID is set via the status interfa...

CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276 Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

CVE-2023-49276: Improper Neutralization of Input During Web Page Generation

Uptime Kuma is an open source self-hosted monitoring tool. In affected versions the Google Analytics element in vulnerable to Attribute Injection leading to Cross-Site-Scripting XSS. Since the custom status interface can set an independent Google Analytics ID and the template has not been...

PT-2023-31314 · Apache +1 · Apache Tiles +1

Name of the Vulnerable Software and Affected Versions: Apache Tiles versions 2 onwards Description: The issue arises from the lack of validation of the value set as the DefaultLocaleResolver.LOCALE KEY attribute on the session while resolving XML definition files. This can lead to possible path...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.3.0-20.0.1, <=0.3.3-20.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.2) +25 more potentially affected by CVE-2022-2232 via org.keycloak:keycloak-services (20.0.1)

org.keycloak:keycloak-services MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.3.0-20.0.1, =0.6, =0.2, =0.2, =0.3, =0.11 -...

Attribute Injection leading to XSS(Cross-Site-Scripting)

Summary Google Analytics element Attribute Injection leading to XSS Details Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. PoC 1. Run the lates...

GHSA-V4V2-8H88-65QJ Attribute Injection leading to XSS(Cross-Site-Scripting)

Summary Google Analytics element Attribute Injection leading to XSS Details Since the custom status interface can set an independent Google Analytics ID and the template has not been sanitized, there is an attribute injection vulnerability here, which can lead to XSS attacks. PoC 1. Run the lates...

PT-2023-31143 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma versions prior to 1.23.7 Description: The Google Analytics element in Uptime Kuma is vulnerable to Attribute Injection, leading to Cross-Site-Scripting XSS attacks. This occurs because the custom status interface can set an...

Jetpack < 12.8-a.3 - Contributor+ Stored XSS via block attribute

Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-5048 WDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ContactFormBuilder' shortcode in versions up to, and including, 1.0.72 due to insufficient input sanitization and output escaping on 'id' user supplied attribute. This makes it possible for...

CVE-2023-5048: Improper Neutralization of Input During Web Page Generation

The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ContactFormBuilder' shortcode in versions up to, and including, 1.0.72 due to insufficient input sanitization and output escaping on 'id' user supplied attribute. This makes it possible for...

CVE-2023-49060

An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the referrerpolicy attribute. This vulnerability affects Firefox for iOS 120...

CVE-2023-45886

The BGP daemon bgpd in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute...

Code injection

The BGP daemon bgpd in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute...

PT-2023-29747

Name of the Vulnerable Software and Affected Versions IP Infusion ZebOS versions 7.10.6 and earlier Description The issue allows remote attackers to cause a denial of service by sending crafted BGP update messages containing a malformed attribute. This is related to the BGP daemon bgpd in IP...