PT-2023-4820 · Xwiki +1 · Xwiki Platform +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.6 XWiki Platform versions prior to 15.1 XWiki Platform versions older than 14.6RC1 with CKEditor Integration extension prior to 1.64.9 Description: The issue allows any user with edit rights to edit all...

CVE-2023-34934

A stack overflow in the EditBasicSSID5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2023-34934

A stack overflow in the EditBasicSSID5G function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2023-34930

A stack overflow in the EditMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2023-34930

A stack overflow in the EditMacList function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2023-34928

A stack overflow in the EditBasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...

CVE-2023-34928

A stack overflow in the EditBasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service DoS via a crafted POST request...

PT-2023-25063 · H3C · H3C Magic

Name of the Vulnerable Software and Affected Versions: H3C Magic version B1STV100R012 Description: A stack overflow in the Edit BasicSSID 5G function allows attackers to cause a Denial of Service DoS via a crafted POST request to the affected API endpoint. Recommendations: For H3C Magic version...

CVE-2020-18410

A stored cross site scripting XSS vulnerability in /index.php?admin-master-article-edit of Chaoji CMS v2.18 that allows attackers to obtain administrator privileges...

Chaojicms 跨站脚本漏洞

Chaojicms is a super Cms web management system. A security vulnerability exists in Chaojicms v2.18, which originated from a discovery via /index.php?admin-master-article-edit that contains a cross-site scripting vulnerability. The vulnerability is exploited by an attacker to gain administrator...

CVE-2023-36666

INEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php, edit-form.foil.php, page-header-preamble.foil.php, overview.foil.php, cust.foil.php, and view.foil.php may be affected...

Cross site scripting

XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload ...

CVE-2023-35153 XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters

XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload ...

FastAsyncWorldEdit 资源管理错误漏洞

FastAsyncWorldEdit is a fork of WorldEdit with huge speed and memory improvements and many more features. A resource management error vulnerability exists in FastAsyncWorldEdit FAWE versions prior to 2.6.3, which stems from a vulnerability that allows an attacker to select the Shuowei region with...

Flask-AppBuilder 安全漏洞

Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.3.2, which can be exploited by an attacker to trigger a database error by adding special characters to the Add, Edit user form...

PT-2023-3566 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed version Description: The issue is related to insufficient input validation when processing topic titles, allowing a remote attacker to impact the integrity and availability ...

GHSA-G75C-CJR6-39MC XWiki Platform's Mail.MailConfig can be edited by any user with edit rights

Impact Mail.MailConfig can be edited by any logged-in user by default. Consequently, they can: - change the mail obfuscation configuration - view and edit the mail sending configuration, including the smtp domain name and credentials. Patches The problem has been patched on XWiki 14.4.8, 15.1, an...

Stored XSS on user "Edit own profile" function

Description An attacker can inject malicious executable scripts into the code of the Social media field Proof of Concept Log in as a Member user, access My profile - Edit own profile function, insert this payload to any field " autofocus onfocus=promptdocument.domain then click Save. Access the...

CVE-2023-2791 Playbooks lets you edit arbitrary posts

When creating a playbook run via the /dialog API, Mattermost fails to validate all parameters, allowing an authenticated attacker to edit an arbitrary channel post...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from an input validation error vulnerability that stems from Mattermost's inability to validate all parameters when creating scripts that run through the /dialog API, which can be...