GHSA-JWV5-8MQV-G387 Cross-site scripting on application summary component

Summary Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. Impact All unpatched versions of Argo CD starting with v1.0.0 are...

Cross-site scripting on application summary component

Summary Due to the improper URL protocols filtering of links specified in the link.argocd.argoproj.io annotations in the application summary component, an attacker can achieve cross-site scripting with elevated permissions. Impact All unpatched versions of Argo CD starting with v1.0.0 are...

Spring Framework Security Vulnerabilities

Spring Framework is the U.S. Spring team of a set of open source Java, JavaEE application framework. The framework helps developers build high-quality applications. A security vulnerability exists in Spring Framework that stems from the vulnerability to open redirection or server request forgery...

Liferay DXP Security Vulnerability

Liferay DXP is a suite of digital experience collaboration platforms from Liferay USA. A security vulnerability exists in Liferay DXP that stems from an open redirection vulnerability that allows remote attackers to redirect users to arbitrary external URLs via the...

The vulnerability of the Qualys Policy Compliance Connector Plugin lies in the improper restriction of XML links to external objects, which allows attackers to perform XXE attacks.

The vulnerability of the Qualys Policy Compliance Connector Plugin is related to an incorrect limitation on XML links to external objects. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute XXE attacks using specially created XML code...

PT-2023-31149 · Unknown · Calendarinho

Name of the Vulnerable Software and Affected Versions: Calendarinho versions prior to commit 15b2393 Description: An Open Redirect issue occurs when the application redirects users to external URLs without proper validation, potentially leading to phishing attacks and information theft. This can...

GLSA-202311-15 : LibreOffice: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202311-15 LibreOffice: Multiple Vulnerabilities - Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will...

The vulnerability of server-based corporate software for monitoring and managing project knowledge bases in Adobe RoboHelp Server stems from improper restrictions on XML links to external objects. This allows attackers to gain unauthorized access to protected information or cause service failures.

The vulnerability of server-based corporate software for project monitoring and management in Adobe RoboHelp Server relates to incorrect restrictions on XML links to external objects. Exploitation of this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access...

Oracle Linux 9 : libreoffice (ELSA-2023-6508)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6508 advisory. - Resolves: rhbz2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula Parsing - Resolves: rhbz2210197 CVE-2023-2255 libreoffice: Remote documents...

RHEL 8 : libreoffice (RHSA-2023:6933)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6933 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor...

elektro-assmann.de Cross Site Scripting vulnerability OBB-3776289

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

libreoffice: Remote documents loaded without prompt via IFrame

A vulnerability was found in LibreOffice. Improper access control in the editor components of The Document Foundation in LibreOffice allows an attacker to craft a document that causes external links to load without a prompt. In the affected versions of LibreOffice documents that used "floating...

CVE-2023-42222

WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal function without verifying that the URL is for an http or https resource, in some circumstances...

SUSE CVE-2023-39365

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advise...

DEBIAN-CVE-2023-39365

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advise...

UBUNTU-CVE-2023-39365

Cacti is an open source operational monitoring and fault management framework. Issues with Cacti Regular Expression validation combined with the external links feature can lead to limited SQL Injections and subsequent data leakage. This issue has been addressed in version 1.2.25. Users are advise...

PT-2023-5428 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.25 Description: The issue is related to Cacti, an open source operational monitoring and fault management framework. It involves problems with Regular Expression validation combined with the external links feature,...

Liberapay: Twitter account hijack @Costalfy

A broken link on the Liberapay website allowed attackers to hijack the Twitter account of Andy Costanza, potentially leading to scams or phishing attempts...

PT-2023-5922 · Sap · Sap Powerdesigner Client

Name of the Vulnerable Software and Affected Versions: SAP PowerDesigner Client version 16.7 Description: The issue is related to the import function of BPMN files in the Business Process Modeling BPM module of the SAP PowerDesigner enterprise architecture modeling tool. It does not sufficiently...

Authorization Bypass

libreoffice is vulnerable to Authorization Bypasses. Improper access control in editor components allows an attacker to craft a document that would cause external links to be loaded without prompt. The documents that uses floating frames linked to external files, would load the contents of those...