TYPO3 8.7.42 < 8.7.55 ELTS / 9.5.29 < 9.5.44 ELTS / 10.4.19 < 10.4.41 ELTS / 11.3.2 < 11.5.33 / 12.0.0 < 12.4.8 XSS (TYPO3-CORE-SA-2023-007)

The version of TYPO3 installed on the remote host is prior to 8.7.42 8.7.55 ELTS / 9.5.29 9.5.44 ELTS / 10.4.19 10.4.41 ELTS / 11.3.2 11.5.33 / 12.0.0 12.4.8. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2023-007 advisory. - DOM processing instructions are not...

TYPO3 Security Vulnerabilities

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 that stems from DOM processing instructions not being handled correctly, allowing bypassing the cross-site scripting mechanism of...

MyBB < 1.8.37 Multiple XSS Vulnerabilities

MyBB is prone to multiple cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...

Cross site scripting

Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting XSS vulnerability enables privilege escalation of authenticated users. The SVG element filtering mechanism intended to stop XSS attacks through uploaded SVG images, is insufficien...

CVE-2023-46251

MyBB is a free and open source forum software. Custom MyCode BBCode for the visual editor SCEditor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as...

Design/Logic Flaw

MyBB is a free and open source forum software. Custom MyCode BBCode for the visual editor SCEditor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as...

CVE-2023-46251 Visual editor persistent Cross-site Scripting (XSS) in MyBB

MyBB is a free and open source forum software. Custom MyCode BBCode for the visual editor SCEditor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as...

CVE-2023-46251 Visual editor persistent Cross-site Scripting (XSS) in MyBB

MyBB is a free and open source forum software. Custom MyCode BBCode for the visual editor SCEditor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as...

CVE-2023-46251

Summary: CVE-2023-46251 is a DOM-based XSS vulnerability in MyBB’s visual editor (SCEditor) caused by improper escaping of input in custom MyCode. This can be triggered when a victim loads a page with a pre-filled or crafted MyCode message (e.g., posts or private messages). The issue can affect p...

Rocky Linux 8 : idm:DL1 and idm:client (RLSA-2021:1846)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:1846 advisory. - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one...

F5 Networks BIG-IP : jQuery vulnerability (K66544153)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K66544153 advisory. In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted...

F5 Networks BIG-IP : BIG-IP TMUI vulnerability (K42526507)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.4.1 / 14.1.4.2 / 15.1.3 / 16.0.1.2 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K42526507 advisory. - On BIG-IP version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3, 14.1.x before...

F5 Networks BIG-IP : jQuery vulnerability (K02453220)

The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.3.1 / 17.5.1.4. It is, therefore, affected by a vulnerability as referenced in the K02453220 advisory. In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after...

F5 Networks BIG-IP : TMUI XSS vulnerability (K24301698)

The version of F5 Networks BIG-IP installed on the remote host is prior to 14.1.4.3 / 15.1.3.1 / 16.0.1.2 / 16.1.0. It is, therefore, affected by a vulnerability as referenced in the K24301698 advisory. - On version 16.0.x before 16.0.1.2, 15.1.x before 15.1.3.1, and 14.1.x before 14.1.4.3, a DOM...

CVE-2023-5895

Cross-site Scripting XSS - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

Cross site scripting

Cross-site Scripting XSS - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

CVE-2023-5895 Cross-site Scripting (XSS) - DOM in pkp/pkp-lib

Cross-site Scripting XSS - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

CVE-2023-5895

CVE-2023-5895 affects the PKP library (pkp/pkp-lib) prior to 3.3.0-16, with a DOM-based Cross-site Scripting (XSS) flaw caused by unescaped user input in the web output. Public references in Red Hat and OSV/NVD confirm the issue as XSS in pkp/pkp-lib, tracked across multiple sources. The vulnerab...

CVE-2023-5895 Cross-site Scripting (XSS) - DOM in pkp/pkp-lib

Cross-site Scripting XSS - DOM in GitHub repository pkp/pkp-lib prior to 3.3.0-16...

SUSE CVE-2020-25715

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity...