CVE-2023-32685

Kanboard (Kanban project management) contains a clipboard-based XSS flaw tracked as CVE-2023-32685. The root cause is improper handling of elements under contentEditable, enabling a low-privileged attacker with document-attachment permission to inject arbitrary HTML via malicious clipboard conten...

CVE-2023-32685

Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the contentEditable element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document...

CVE-2021-21366

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpect...

DOM Cross Site Scripting and openredirect

Vulnerable Endpoint: https://demo.saleor.io/default-channel/en-US/account/login/?next=javascript:alert1 Description: 1. Hello team, Recently i found that, on saleor React storefront dashboard there is a DOM XSS and open-redirect vulnerability Steps to reproduce XSS: 1. Go to the above mentioned...

Input validation

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

html inputs of type password recorded in plaintext when converted to text inputs

Impact Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs. A customer may assume that switching to type="text"...

Ubuntu 20.04 LTS / 22.04 LTS : xmldom vulnerabilities (USN-6102-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6102-1 advisory. It was discovered that xmldom incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially...

@devlego/builder (>=1.1.29-alpha.1, <=1.1.34), @metro-fs/analytics-plugin-posthog (>=1.0.0, <=1.6.0) +6 more potentially affected by CVE-2023-32325 via posthog-js (>=1.4.5, <=1.53.2)

posthog-js NPM version =1.4.5, =1.1.29-alpha.1, =1.0.0, =2.1.0, =2.0.5, =1.3.39, =3.28.0-rc.1, =1.16.0, =1.16.1 Source cves: CVE-2023-32325 Source advisory: OSV:GHSA-8775-5HWV-WR6V...

U.S. Dept Of Defense: DOM-XSS

A DOM-XSS vulnerability was found on a subdomain of a website, which could allow an attacker with access to the Siteminder CA to perform a cross-site scripting attack and cause information leaks, privilege escalation, and/or denial of service. The vulnerability was assigned CVE-2013-5968 and a...

CVE-2023-2614

Cross-site Scripting XSS - DOM in GitHub repository pimcore/pimcore prior to 10.5.21...

Cross site scripting

Cross-site Scripting XSS - DOM in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2614

CVE-2023-2614 describes a cross-site scripting (XSS) vulnerability in Pimcore’s codebase (pimcore/pimcore) prior to version 10.5.21, attributed to a DOM-based flaw. The Red Hat advisories, CNVD, OSV, and GitHub advisory entries consistently reference this same issue as a DOM XSS in Pimcore’s prod...

CVE-2023-2614 Cross-site Scripting (XSS) - DOM in pimcore/pimcore

Cross-site Scripting XSS - DOM in GitHub repository pimcore/pimcore prior to 10.5.21...

CVE-2023-2614 Cross-site Scripting (XSS) - DOM in pimcore/pimcore

Cross-site Scripting XSS - DOM in GitHub repository pimcore/pimcore prior to 10.5.21...

PostMessage Wildcard Event Listener Detected

Web applications relying on JavaScript often need to perform cross-origin communication between Window objects such as a page and an embedded iframe or a popup window. The postMessage API allows developers to circumvent the same-origin policy restrictions in order to exchange data between scripts...

CVE-2023-24744

Cross Site Scripting XSS vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onload function within the application DOM...

CVE-2023-24744

Cross Site Scripting XSS vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onload function within the application DOM...

CVE-2023-24744

Cross Site Scripting XSS vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onload function within the application DOM...

CVE-2023-30454

An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be...

CVE-2023-30454

An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be...