CVE-2022-20615

Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Agent/Configure permission...

CVE-2021-45473

A flaw was found in mediawiki through version 1.37. Wikibase item descriptions allow cross-site scripting attacks XSS, which is triggered upon a visit to an action=info URL aka a page-information sidebar...

CVE-2021-45473

In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL aka a page-information sidebar...

Design/Logic Flaw

In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL aka a page-information sidebar...

CVE-2021-45473

In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL aka a page-information sidebar...

PT-2021-24245 · Mediawiki · Mediawiki

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.37 and earlier Description: The issue allows XSS in Wikibase item descriptions, which is triggered when visiting an action=info URL, also known as a page-information sidebar. Recommendations: For MediaWiki versions 1.37 a...

CVE-2021-24515

The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues...

WordPress + Microsoft Office 365 < 15.4 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise error descriptions before outputting them in the log notice, which could allow unauthenticated users to perform Cross-Site Scripting attacks against a logged in administrator PoC POST / HTTP/1.1 Content-Length: 242 Content-Type: application/x-www-form-urlencoded...

CVE-2021-39537

A heap overflow vulnerability has been found in the ncurses package, particularly in the "tic". This flaw results from a lack of proper bounds checking during input processing. By exploiting this boundary error, an attacker can create a malicious file, deceive the victim into opening it using the...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to uncontrolled resource consumption, allows a hacker to trigger a service failure.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions by presenting a long description of the problem or...

PT-2021-10550 · Suse · Suse

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: The provided information does not contain details about a specific issue, as it refers to a duplicate candidate that has been removed to prevent accidental usage. It mentions...

GitLab Resource Management Error Vulnerability (CNVD-2021-40770)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A resource management error vulnerability exists in GitLa...

UBUNTU-CVE-2021-22216

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description...

CVE-2021-21660

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...

CVE-2021-21660

Jenkins Markdown Formatter Plugin 0.1.0 and earlier does not sanitize crafted link target URLs, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter...

Stored XSS vulnerability in build-with-parameters

build-with-parameters 1.5 and earlier does not escape parameter names and descriptions. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Job/Configure permission. build-with-parameters 1.5.1 escapes parameter names and descriptions...

PT-2021-14665 · Jenkins · Jenkins Artifact Repository Parameter Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Artifact Repository Parameter Plugin versions 1.0.0 and earlier Description: The issue results in a stored cross-site scripting XSS vulnerability because parameter names and descriptions are not escaped. This vulnerability is...

Stored XSS vulnerability in repository-connector

repository-connector 2.0.2 and earlier does not escape parameter names and descriptions for past builds. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. repository-connector 2.0.3 escapes parameter names and descriptions whe...

CVE-2021-21260

Online Invoicing System OIS is open source software which is a lean invoicing system for small businesses, consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf...

PT-2021-4084 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 13.10.5 GitLab CE/EE versions prior to 13.11.5 GitLab CE/EE versions prior to 13.12.2 Description: The issue is related to uncontrolled resource consumption, which can be exploited by an attacker to cause a deni...