CVE-2022-38172

ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard...

Cross site scripting

ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard...

CVE-2022-38172

ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard...

CVE-2022-38172

CVE-2022-38172 is a documented XSS in ServiceNow’s Performance Analytics dashboard creation via the name field, affecting versions up to San Diego Patch 3. The NVD entry lists CVSS v3.1 metrics: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N with a base score of 6.1 (Medium). Public references indicate the ...

ServiceNow San Diego Patch 跨站脚本漏洞

ServiceNow San Diego Patch is a series of patches from ServiceNow USA. A cross-site scripting vulnerability exists in ServiceNow San Diego Patch 3 and prior versions, which stems from allowing XSS via the name field when creating new dashboards for the Performance Analytics Dashboard...

PT-2022-24257 · Servicenow · Servicenow

Name of the Vulnerable Software and Affected Versions: ServiceNow versions through San Diego Patch 3 Description: The issue allows for XSS via the name field during the creation of a new dashboard for the Performance Analytics dashboard. Recommendations: For versions through San Diego Patch 3,...

CVE-2021-24911

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tptranslation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack...

CVE-2021-24911

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tptranslation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack...

Cross site scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tptranslation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack...

CVE-2021-24911 Transposh WordPress Translation < 1.0.8 - Stored Cross-Site Scripting

The Transposh WordPress Translation WordPress plugin before 1.0.8 does not sanitise and escape the tk0 parameter from the tptranslation AJAX action, leading to Stored Cross-Site Scripting, which will trigger in the admin dashboard of the plugin. The minimum role needed to perform such attack...

MAL-2022-5900 Malicious code in sa-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6076fbcca2b163b236b9e00a0d145fc1dd8e8a8bbba34b074cc93f2e54b2fe7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sa-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6076fbcca2b163b236b9e00a0d145fc1dd8e8a8bbba34b074cc93f2e54b2fe7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Weak Password Change Mechanism

Description The user password change page, doesn't require knowledge of the existing password. Proof of Concept 1. - Log in as a normal user 2. - Go to the User Dashboard page and click User Settings. 3. - Set a any new password. 4. - Click confirm 5. - The password is changed successfully...

Directus 安全漏洞

Directus is a real-time Api and application dashboard. It is used to manage Sql database content. A security vulnerability exists in Directus, which can be exploited by an attacker to abort the Directus process...

The vulnerability of the command-line interface (CLI) of the Cisco Nexus Dashboard platform, a tool for analyzing and automating cloud network management, allows a perpetrator to escalate their privileges.

The vulnerability of the command-line interface CLI of the Cisco Nexus Dashboard platform for analyzing and automating cloud network management exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the command-line interface (CLI) of the Cisco Nexus Dashboard platform, a tool for analyzing and automating cloud network management, allows a perpetrator to escalate their privileges.

The vulnerability of the command-line interface CLI of the Cisco Nexus Dashboard platform for analyzing and automating cloud network management exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the command-line interface (CLI) of the Cisco Nexus Dashboard platform, a tool for analyzing and automating cloud network management, allows a perpetrator to escalate their privileges.

The vulnerability of the command-line interface CLI of the Cisco Nexus Dashboard platform for analyzing and automating cloud network management exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the command-line interface (CLI) of the Cisco Nexus Dashboard platform, a tool for analyzing and automating cloud network management, allows a hacker to escalate their privileges.

The vulnerability of the command-line interface CLI of the Cisco Nexus Dashboard platform for analyzing and automating cloud network management exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2022-37438

In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information for example, username, email, and real name about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user...

CVE-2022-37438

In Splunk Enterprise versions in the following table, an authenticated user can craft a dashboard that could potentially leak information for example, username, email, and real name about Splunk users, when visited by another user through the drilldown component. The vulnerability requires user...