16529 matches found
CVE-2023-46251 Visual editor persistent Cross-site Scripting (XSS) in MyBB
MyBB is a free and open source forum software. Custom MyCode BBCode for the visual editor SCEditor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as...
CVE-2023-46251 Visual editor persistent Cross-site Scripting (XSS) in MyBB
MyBB is a free and open source forum software. Custom MyCode BBCode for the visual editor SCEditor doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active e.g. as...
PT-2023-29931 · Mybb +1 · Mybb +1
Name of the Vulnerable Software and Affected Versions: MyBB versions prior to 1.8.37 Description: The issue arises from custom MyCode BBCode for the visual editor SCEditor not escaping input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited b...
Fedora: Security Advisory (FEDORA-2023-426b3a500d)
The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2023-403)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-403 advisory. NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960. CVE-2023-5441 Use After Free in GitHub repository vim/vim prior to v9.0.2010...
[SECURITY] Fedora 39 Update: vim-9.0.2048-1.fc39
VIM VIsual editor iMproved is an updated and improved version of the vi editor. Vi was the first real screen-based editor for UNIX, and is still very popular. VIM improves on vi by adding new features: multiple windows, multi-level undo, block highlighting and more...
CVE-2023-46404
PCRS = 3.11 d0de1e “Questions” page and “Code editor” page are vulnerable to remote code execution RCE by escaping Python sandboxing...
CVE-2023-46404
PCRS = 3.11 d0de1e “Questions” page and “Code editor” page are vulnerable to remote code execution RCE by escaping Python sandboxing...
CVE-2023-46404
PCRS (PHP-based web app for online programming exercises) versions prior to 3.11 (d0de1e) are vulnerable to remote code execution via the "Questions" page and the "Code editor" page. The root cause is escaping Python sandboxing, enabling attacker-controlled code execution. Public advisories consi...
The vulnerability of the `foogallery_image_editor_modal` function in the FooGallery plugin of the WordPress content management system allows attackers to perform cross-site scripting attacks.
The vulnerability of the foogalleryimageeditormodal function in the FooGallery plugin of the WordPress content management system exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...
CVE-2023-46404
PCRS = 3.11 d0de1e “Questions” page and “Code editor” page are vulnerable to remote code execution RCE by escaping Python sandboxing...
Design/Logic Flaw
Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 b570 or above, A32.50 b390 or above...
CVE-2023-46595 Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor
Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can lead to relay domain attacks. Fixed in A32.20 b570 or above, A32.50 b390 or above...
Design/Logic Flaw
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to version 1.5.10.15, due to a lack of request sanitization in the logs, a malicious request containing XSS would be stored in a log file. When an administrator of the FOG server logged in and viewed the log...
SUSE CVE-2023-28617
org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...
Inkdrop vulnerable to code injection
Overview Inkdrop provided by Takuya Matsuyama is a Markdown editor. Inkdrop contains a code injection vulnerability CWE-94. T.Nodoka reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a specially crafted...
JVN#48057522: Inkdrop vulnerable to code injection
Inkdrop provided by Takuya Matsuyama is a Markdown editor. Inkdrop contains a code injection vulnerability CWE-94. Impact If a specially crafted markdown file is opened using the product, arbitrary code may be executed. Solution Update the Software The developer states that Inkdrop has an...
The vulnerability of the `ga_grow_inner` function in the Vim text editor is caused by a numerical overflow condition, which allows an attacker to trigger a service failure.
The vulnerability of the gagrowinner function in the Vim text editor, a software for Unix-based systems, is caused by a numerical overflow. Exploiting this vulnerability can allow an attacker to cause a service failure...