11559 matches found
GHSA-2HFJ-CXW7-G45P Unsafe inline XSS in pasting DOM element into chat
Impact Inline scripts are executed when Javascript is parsed via a paste action. 1. Open https://watch.owncast.online/ 2. Copy and then paste into the chat field. 3. An alert should pop up. Patches ⋮ 13 │ // Content security policy ⋮ 14 │ csp := string ⋮ 15 │ "script-src 'self'...
Unsafe inline XSS in pasting DOM element into chat
Impact Inline scripts are executed when Javascript is parsed via a paste action. 1. Open https://watch.owncast.online/ 2. Copy and then paste into the chat field. 3. An alert should pop up. Patches ⋮ 13 │ // Content security policy ⋮ 14 │ csp := string ⋮ 15 │ "script-src 'self'...
CVE-2021-42050
An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS...
CVE-2021-42050
An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS...
CVE-2021-42050
An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS...
Cross site scripting
An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS...
CVE-2021-42050
AbanteCart, prior to version 1.3.2, is affected by a DOM-based XSS vulnerability identified as CVE-2021-42050. The issue affects the e-commerce platform’s client-side handling that can be exploited to inject and execute arbitrary scripts in the context of a user’s browser. The available data conf...
CVE-2021-42050
An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS...
AbanteCart 跨站脚本漏洞
AbanteCart is a PHP-based e-commerce platform. AbanteCart 1.3.2 previously had a security vulnerability that could be exploited by attackers to conduct DOM-based XSS attacks...
PT-2021-8014 · H2Database · H2
Name of the Vulnerable Software and Affected Versions: com.h2database:h2 versions 1.4.198 through 2.0.202 Description: The issue is related to XML External Entity XXE Injection via the org.h2.jdbc.JdbcSQLXML class object. This occurs when the object receives parsed string data from the...
CVE-2021-36760
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...
CVE-2021-36760
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...
Open redirect
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...
CVE-2021-36760
WSO2 Identity Server 5.7.0 contains a DOM-Based XSS in accountrecoveryendpoint/recoverpassword.do that manipulates the callback parameter in the URL before the callback is invoked. This can lead to execution of injected JavaScript after the username/password reset flow completes. The same endpoin...
CVE-2021-36760
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...
CVE-2021-40094
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device...
CVE-2021-40094
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device...
CVE-2021-40094
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device...
Design/Logic Flaw
A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited, this vulnerability may allow attackers to inject malicious code into a user's device...