CVE-2021-30082

Gris CMS v0.1 is affected by a persistent XSS vulnerability in admin/dashboard due to insufficient validation of client data. This allows remote attackers to inject arbitrary script/HTML. CNVD notes potential credential theft; no remediation details are provided in the supplied documents.

CVE-2021-30082

An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard...

Cross-Site Scripting (XSS)

Ceph is vulnerable to cross-site scripting. The vulnerability exists due to an improper validation of user-supplied input by the Ceph storage dashboard...

A Simple 1-Click Compromised Password Reset Feature Coming to Chrome Browser

Google on Tuesday announced a new feature to its password manager that could be used to change a stolen password automatically with a single tap. Automated password changes build on the tool's ability to check the safety of saved passwords. Thus when Chrome finds a password that may have been...

CVE-2021-3509

A flaw was found in the Red Hat Ceph Storage Dashboard. In response to CVE-2020-27839, the JWT token was moved from localStorage to an httpOnly cookie. However, token cookies are used in the body of the HTTP response for the documentation, which again makes it available to XSS. The greatest threa...

Script injection without script or programming rights through Gadget titles

Impact A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. Patches The issue has been patched in XWiki 12.6.7, 12.10.3 and 13.0RC1. Workarounds There's no easy workaround for this issue, it is recommended to upgrade...

Android 12 Will Let You Fine-Tune Permissions for Apps

A new privacy dashboard and “app hibernation” are coming to Google's mobile operating system...

Moderate: Red Hat Security Advisory: grafana security, bug fix, and enhancement update

An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RLSA-2021:1859 Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have been upgraded to a later upstream version: grafana 7.3.6. BZ1850471 Security Fixes: crewjam/saml: authentication bypass in saml authentication CVE-2020-27846...

grafana security, bug fix, and enhancement update

An update is available for grafana. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor fo...

Moderate: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. The following packages have been upgraded to a later upstream version: grafana 7.3.6. BZ1850471 Security Fixes: crewjam/saml: authentication bypass in saml authentication CVE-2020-27846...

PT-2021-19813 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 12.6.7 XWiki Platform versions prior to 12.10.3 Description: A user without Script or Programming right is able to execute script requiring privileges by editing gadget titles in the dashboard. Recommendations...

CVE-2021-24327

The SEO Redirection Plugin – 301 Redirect Manager WordPress plugin before 6.4 did not sanitise the Redirect From and Redirect To fields when creating a new redirect in the dashboard, allowing high privilege users even with the unfilteredhtml disabled to set XSS payloads...

CVE-2021-24323

CVE-2021-24323 affects the WordPress WooCommerce plugin (vulnerable when taxes are enabled). The issue arises from the Additional tax classes field being not properly sanitised/escaped before output in the admin dashboard, enabling an authenticated admin to inject XSSayloads. The vulnerability ap...

Customer Relationship Management (CRM) System 1.0 - (Category) Persistent Cross site Scripting

Exploit Title: Customer Relationship Management CRM System 1.0 - 'Category' Persistent Cross site Scripting Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting

Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting Date: 16-05-2021 Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html Version:...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A cross-site scripting vulnerability exists in the...

TYPO3 XXE Vulnerability (TYPO3-CORE-SA-2020-012)

TYPO3 is prone to an XML external entity XXE vulnerability in the Dashboard widget. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Simple Chatbot Application 1.0 Cross Site Scripting

Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting Date: 16-05-2021 Exploit Author: Vani K G Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html Version:...

Photo Gallery < 1.5.67 - Authenticated Stored Cross-Site Scripting via Gallery Title

The plugin did not properly sanitise the gallery title, allowing high privilege users to create one with XSS payload in it, which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117 PoC...