CVE-2022-29455 WordPress Elementor plugin <= 3.5.5 - Unauthenticated DOM-based Reflected Cross-Site Scripting (XSS) vulnerability

DOM-based Reflected Cross-Site Scripting XSS vulnerability in Elementor's Elementor Website Builder plugin = 3.5.5 versions...

PT-2022-3505 · Elementor · Elementor Website Builder

Name of the Vulnerable Software and Affected Versions: Elementor Website Builder plugin versions prior to 3.5.6 Description: The issue is related to insufficient protection of the webpage structure, allowing a remote attacker to perform cross-site scripting. This is a DOM-based Reflected Cross-Si...

Elementor < 3.5.6 - DOM Reflected Cross-Site Scripting

The plugin does not sanitise and escape user input appended to the DOM via malicious Lightbox settings, resulting in a DOM Cross-Site Scripting issue PoC...

Elementor < 3.5.6 - DOM Reflected Cross-Site Scripting

The plugin does not sanitise and escape user input appended to the DOM via malicious Lightbox settings, resulting in a DOM Cross-Site Scripting issue...

CVE-2017-20027

The CVE-2017-20027 issue affects HumHub up to version 1.0.1 and is described as a DOM-based cross-site scripting vulnerability stemming from lack of input/data filtering. The attack could be launched remotely and exploit details are publicly disclosed; upgrading to version 1.1.1 is listed as the ...

CVE-2017-20027 HumHub DOM cross site scriting

A vulnerability was found in HumHub up to 1.0.1 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting DOM. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to...

CVE-2022-2029

Cross-site Scripting XSS - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0...

Cross site scripting

Cross-site Scripting XSS - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0...

CVE-2022-2029 Cross-site Scripting (XSS) - DOM in kromitgmbh/titra

Cross-site Scripting XSS - DOM in GitHub repository kromitgmbh/titra prior to 0.77.0...

Client-Side RCE and Stored XSS via Unsafe Deserialization of Diagrams

Description The deserialization mechanism of diagram files is based on an XML like structure. When it is read, internal objects are created and properties on those can be set. Furthermore it allows calling any top-level constructor function and cloning of top level XML/HTML nodes. This has the...

@dmrvos/infrajs (>=0.0.4, <=0.0.8), @marjose/jstoolkit (>=0.0.2, <=1.0.0-beta) +10 more potentially affected by CVE-2021-43306 via jquery-validation (>=1.14.0, <=1.19.1)

jquery-validation NPM version =1.14.0, =0.0.4, =0.0.2, =0.2.2, =3.0.0, =0.11.28, =0.0.8, =1.4.0, =1.0.0, =3.0.0-prerelease.20170216T120000Z, =1.0.0, =1.0.6 - webpack-symfony-builder 1.0.0 Source cves: CVE-2021-43306 Source advisory: OSV:GHSA-J9M2-H2PV-WVPH...

Malicious code in react-dom-router-compatibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4efc1e3fc09e8efb01c5a4b15ee2c17ecab84adb02bd7641fdb76916584aee0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5642 Malicious code in react-dom-router-compatibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4efc1e3fc09e8efb01c5a4b15ee2c17ecab84adb02bd7641fdb76916584aee0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-dom-router-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 982577f3dd90dc874a760dcdc2288ddccc947f0a8410d5ab383e2350556ca1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5643 Malicious code in react-dom-router-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 982577f3dd90dc874a760dcdc2288ddccc947f0a8410d5ab383e2350556ca1fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@hyperledger/cactus-cockpit (0.3.0), @kengic/ng.account (>=3.2.100, <=3.3.127) +17 more potentially affected by CVE-2021-4231 via @angular/core (>=11.0.0, <=11.0.4)

@angular/core NPM version =11.0.0, =3.2.100, =3.2.106, =3.2.100, =1.0.100, =1.0.1-BETA.93934, =1.0.0-BETA.93934, =1.0.59, =1.1.61, =1.0.2, =1.0.7, =0.0.2, =0.0.3 and more Source cves: CVE-2021-4231 Source advisory: OSV:GHSA-C75V-2VQ8-878F...

Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...

GHSA-39CH-RG26-GMQ5 Magento DOM-based Cross-Site Scripting vulnerability on mage-messages cookies

Magento versions 2.4.2 and earlier, 2.4.1-p1 and earlier and 2.3.6-p1 and earlier are affected by a DOM-based Cross-Site Scripting vulnerability on mage-messages cookies. Successful exploitation could lead to arbitrary JavaScript execution by an unauthenticated attacker. User interaction is...

GHSA-G7PC-799Q-743F Magento DOM-based Cross-site scripting vulnerability

Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a dom-based cross-site scripting vulnerability. Successful exploitation could lead to arbitrary code execution...

MediaWiki makeCollapsible allows applying event handler to any CSS selector

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets CSS classes which can affect what content is shown or hidden in the user interface to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler ...