PT-2023-23086 · Foundry · Foundry Frontend

Name of the Vulnerable Software and Affected Versions: Foundry Frontend versions prior to 6.225.0 Description: A security defect was identified in Foundry Frontend that enabled users to potentially conduct DOM XSS attacks if Foundry's Content Security Policy CSP were to be bypassed...

CVE-2023-26446

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker woul...

Code injection

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker woul...

Code injection

The "upsell" widget for the portal allows to specify a product description. This description taken from a user-controllable jslob did not get escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering...

CVE-2023-26447

CVE-2023-26447 affects Open-Xchange AppSuite’s portal upsell widget, where a product description sourced from a user-controllable jslob is inserted into the DOM without proper escaping. The underlying issue is DOM-based XSS: unescaped jslob content can execute script in the victim’s browser, pote...

CVE-2023-26446

CVE-2023-26446 concerns Open-Xchange AppSuite, where the user-controlled clientID value used in the I/O flow for application passwords was not sanitized/escaped before being inserted into the DOM, enabling potential cross-site scripting that could compromise the victim’s session or trigger action...

CVE-2023-26446

The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. Malicious script code can be executed within the victims context. This can lead to session hijacking or triggering unwanted actions via the web interface and API. To exploit this an attacker woul...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability

Open-Xchange AppSuite is a set of Web cloud desktop environments from Open-Xchange Germany. The environment allows users to manage email, tasks, files, etc. more intuitively. A security vulnerability exists in Open-Xchange AppSuite that stems from the clientID not being cleaned up and escaped...

PT-2023-20638 · Ox Software Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue arises from the lack of sanitization or escaping of the user's clientID at "application passwords" before it is added to the DOM. This allows...

Open-Xchange AppSuite Cross-Site Scripting Vulnerability

Open-Xchange AppSuite is a set of Web cloud desktop environments from Open-Xchange Germany. The environment allows users to manage email, tasks, files, etc. more intuitively. A security vulnerability exists in Open-Xchange AppSuite that stems from a user-controllable jslob that is not cleaned up...

UBUNTU-CVE-2023-4048

An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. This vulnerability affects Firefox 116, Firefox ESR 102.14, and Firefox ESR 115.1...

Elementor < 3.5.5 - Iframe Injection

Description The plugin does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs. PoC...

PT-2023-24620

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2...

CVE-2023-3672

Cross-site Scripting XSS - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5...

CVE-2023-3672 Cross-site Scripting (XSS) - DOM in plaidweb/webmention.js

Cross-site Scripting XSS - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5...

CVE-2023-3672 Cross-site Scripting (XSS) - DOM in plaidweb/webmention.js

Cross-site Scripting XSS - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5...

CVE-2023-3672 Cross-site Scripting (XSS) - DOM in plaidweb/webmention.js

Cross-site Scripting XSS - DOM in GitHub repository plaidweb/webmention.js prior to 0.5.5...

CVE-2023-3672

Summary: CVE-2023-3672 affects webmention.js (PlaidWeb) prior to 0.5.5, with a DOM-based cross-site scripting (XSS) vulnerability. The issue exists in the client-side library used to render webmentions, and is documented across multiple sources (GitHub advisories, Red Hat cve entry, OSV, CVE reco...

webmention.js 跨站脚本漏洞

webmention.js is a client-side library from the PlaidWeb project for rendering webmentions from webmention.io. A cross-site scripting vulnerability exists in versions of plaidweb webmention.j prior to 0.5.5, which stems from susceptibility to DOM-based cross-site scripting XSS attacks...

@bnsights-test/test-admin-portal (>=0.0.4, <=0.0.147), @bnsights-test/test-controls (>=0.0.4, <=0.0.63) +27 more potentially affected by unknown CVE via sweetalert2 (>=11.6.15, <=11.22.3)

sweetalert2 NPM version =11.6.15, =0.0.4, =0.0.4, =1.0.0, =1.0.110, =0.0.0-20240903040200, =1.10.0, =15.2.16, =1.0.1, =1.1.16, =1.1.25, =1.0.25, =1.0.17, =1.0.0, =2.0.8, =2.1.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-MRR8-V49W-3333...