com.astrapay:spring-qris (>=1.15, <=1.22), com.capitalone.dashboard:core (4.0.1) +7 more potentially affected by CVE-2022-42252 via org.apache.tomcat.embed:tomcat-embed-core (>=10.1.0-m1, <=10.1.0)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.1.0-m1, =1.15, =3.0.0, =10.1.0-m1, =10.1.0-m1, =3.18.0, =3.20.1 Source cves: CVE-2022-42252 Source advisory: MEND:CVE-2022-42252...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.6.0.0), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +10907 more potentially affected by CVE-2022-42252 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.67)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.4.2, =1.6.6, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2022-42252 Source advisory: MEND:CVE-2022-42252...

ca.bc.gov.tno:dal-db (>=0.0.11-alpha, <=0.0.17-alpha), cn.taketoday:today-framework (4.0.0-draft.1) +22 more potentially affected by CVE-2022-42252 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.26)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.0.11-alpha, =0.0.1, =1.3.3, =2.1.1, =2.1.0, =2.1.3, =2.1.0, =2.1.0, =0.5.0-release, =3.4.8, =3.5.4-jdk11 - io.axual.platform.test:axual-platform-test-standalone 5.8.0 and more Source cves: CVE-2022-42252 Source advisory:...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4099 more potentially affected by CVE-2022-42252 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.82)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2022-42252 Source...

Contact Bank <= 3.0.30 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Create/edit a form and put the following...

Bitcoin / Altcoin Faucet <= 1.6.0 - Settings Update to Stored XSS via CSRF

The plugin does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues Make a logged in admin open a page...

CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

GHSA-42WQ-RCH8-6F6J CKEditor5 cross-site scripting vulnerability caused by the editor instance destroying process

Affected packages @ckeditor/ckeditor5-markdown-gfm @ckeditor/ckeditor5-html-support @ckeditor/ckeditor5-html-embed Impact A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages. The vulnerability allowed to trigger a JavaScript code after fulfillin...

CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

UBUNTU-CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

CVE-2022-31175

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

2read-ckeditor5-custom-build (>=25.0.0, <=25.1.2), @8trhieu/ckeditor5-build-classic-custom (>=0.0.1, <=0.0.5) +213 more potentially affected by CVE-2022-31175 via @ckeditor/ckeditor5-html-embed (>=0.0.0-internal-20241017.0, <=34.2.0)

@ckeditor/ckeditor5-html-embed NPM version =0.0.0-internal-20241017.0, =25.0.0, =0.0.1, =1.0.7, =34.1.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0,...

PT-2022-20587

Name of the Vulnerable Software and Affected Versions CKEditor 5 versions prior to 35.0.1 Description A cross-site scripting issue has been discovered in CKEditor 5, affecting three optional packages: @ckeditor/ckeditor5-markdown-gfm, @ckeditor/ckeditor5-html-support, and...

CVE-2022-31175: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a JavaScript rich text editor. A cross-site scripting vulnerability has been discovered affecting three optional CKEditor 5's packages in versions prior to 35.0.1. The vulnerability allowed to trigger a JavaScript code after fulfilling special conditions. The affected packages are...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

Design/Logic Flaw

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

CVE-2022-30929 affects Mini-Tmall v1.0 and is described as vulnerable to insecure permissions via the Tomcat Jasper embedding component (tomcat-embed-jasper). Several connected sources reiterate an insecure privilege/permission issue, including Red Hat and CNNVD entries, which label it as an inse...