WordPress BulletProof Securitys plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. WordPress BulletProof Securitys plugin versions prior to 6.1 have a cross-site scripting vulnerability that...

Cisco UCS Director 跨站脚本漏洞

Cisco UCS Director is a private cloud infrastructure-as-a-service IaaS heterogeneous platform from Cisco Cisco U.S. A cross-site scripting vulnerability exists in versions prior to Cisco UCS Director 6.6, which stems from a lack of data validation filtering of user-supplied data and output. An...

GHSA-WVMQ-W7M8-G9XM Insecure cookie storage in Apache Atlas

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...

Insecure cookie storage in Apache Atlas

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script...

A week in security (May 9 – 15)

Last week on Malwarebytes Labs: How to spot the signs of a virtual kidnap scam Virtual credit cards coming to Chrome: What you need to know Clearview AI banned from selling facial recognition data in the US Cyberattacks on SATCOM networks attributed to Russian threat actors F5 BIG-IP vulnerabilit...

WordPress plugin BulletProof Security 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. WordPress BulletProof Securitys plugin versions prior to 6.1 have a cross-site scripting vulnerability that...

Cybozu Garoon 跨站脚本漏洞

Cybozu Garoon is a portal-based OA office system from Cybozu Japan. A cross-site scripting vulnerability exists in Cybozu Garoon, which is caused by a failure to adequately clean user-supplied data in the scheduler. An attacker could exploit the vulnerability to execute JavaScript code on the...

JetBrains TeamCity Cross-Site Scripting Vulnerability (CNVD-2022-55670)

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. A cross-site scripting vulnerability exists in versions prior to JetBrains TeamCity 2022.04. The vulnerability stems from a lack of data validation filtering of user-supplied data a...

Aruba ClearPass Policy Manager 跨站脚本漏洞

Aruba ClearPass Policy Manager is an application of the U.S. company Aruba to provide wireless network security access management system Aruba ClearPass Policy Manager has a cross-site scripting vulnerability, an attacker can use the vulnerability to execute JavaScript code on the client side...

GNUBOARD5 跨站脚本漏洞

GNUBOARD5 is a PHP and MySQL-based Web forum system. GNUBOARD5 versions 5.55 and 5.56 are vulnerable to a cross-site scripting vulnerability, which originates in bbs/memberconfirm.php and lacks a data validation filter for user-supplied data and output. An attacker could exploit this vulnerabilit...

GHSA-C438-8CVQ-PXXX Apache Tapestry Unsafe Object Storage

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service resource consumption or execute arbitrary code via crafted serialized data...

Alt-N Mdaemon Cross-Site Scripting Vulnerability

Alt-N MDaemon is a mail service system from Alt-N USA that provides complete mail server functionality, protects users from spam, enables web login to send and receive mail, supports remote management, and when used in conjunction with the MDaemon AntiVirus plugin, it also protects the system...

Survey Sparrow Enterprise Survey Software Cross-Site Scripting Vulnerability

Survey Sparrow Enterprise Survey Software is an enterprise survey software from Survey Sparrow, Inc. A cross-site scripting vulnerability exists in Survey Sparrow Enterprise Survey Software version 2022, which stems from a lack of data validation filtering in the Signup parameter is missing a dat...

CVE-2022-23165

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...

Cross site scripting

Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting XSS - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected produc...

SAP NetWeaver ABAP Server Cross-Site Scripting Vulnerability

SAP NetWeaver ABAP Server is a Web application server for SAP products from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver ABAP Server, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...

Alt-N MDaemon 跨站脚本漏洞

Alt-N MDaemon is a mail service system from Alt-N USA that provides complete mail server functionality, protects users from spam, enables web login to send and receive mail, supports remote management, and when used in conjunction with the MDaemon AntiVirus plugin, it also protects the system...

Client side scanning may cost more than it delivers

On May 11, 2022, the EU will publicize a proposal for a law on mandatory chat control. The European Commission wants all providers of email, chat and messaging services to search for suspicious messages in a fully automated way and forward them to the police in the fight against child pornography...

Cross-site Scripting (XSS) in Search Fuction with filter

Description The is an XSS could be trigger via search function in number filter. Cross-site Scripting XSS refers to client-side code injection attack wherein an attacker can execute malicious scripts into a legitimate website or web application. XSS occurs when a web application makes use of...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver ABAP Server is a Web application server for SAP products from SAP Germany. A cross-site scripting vulnerability exists in SAP NetWeaver ABAP Server, which stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this...