CVE-2022-1231 XSS via Embedded SVG in SVG Diagram Format in plantuml/plantuml

XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context, this ranges from stealing secrets to account hijacking or even to code execution for example in desktop...

cross-fetch 安全漏洞

cross-fetch is a generic WHATWG Fetch API for nodes, browsers, and React Native by Leonardo Quixada, an individual developer in the United States. A security vulnerability exists in cross-fetch that stems from exposing private personal information to unauthorized participants in the GitHub...

Cross site scripting

Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4...

CVE-2022-1351

Pimcore Pimcore prior to version 10.4 is affected by a stored cross-site scripting (XSS) vulnerability in Tooltip. The CVE-2022-1351 entry documents a stored XSS issue originating from Tooltip in the Pimcore web UI, affecting versions before 10.4. CVSS metrics indicate a medium base score (CVSS 3...

CVE-2021-31805

creationtimestamp| type| source ---|---|--- 2022-04-13 21:36:47+00:00| seen| https://t.me/ctinow/50238 2022-04-14 16:45:03+00:00| exploited| https://t.me/truesecator/2850 2022-04-15 11:33:35+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1954 2023-04-27 09:58:59+00:00| confirmed|...

Cross site scripting

Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation...

CVE-2022-1347 Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in causefx/organizr

Stored XSS in the "Username" & "Email" input fields leads to account takeover of Admin & Co-admin users in GitHub repository causefx/organizr prior to 2.1.1810. Account takeover and privilege escalation...

Cross site scripting

Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

Cross site scripting

Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

CVE-2022-1345 Stored XSS viva .svg file upload in causefx/organizr

Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

CVE-2022-1345 Stored XSS viva .svg file upload in causefx/organizr

Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

CVE-2022-1344

CVE-2022-1344 : Stored XSS in Organizr (causefx/organizr) due to missing sanitization of filenames, affecting versions prior to 2.1.1810. Malicious script in a filename can run in the user’s browser, with potential for session hijacking and data exposure. Affected: Organizr before 2.1.1810. Mitig...

CVE-2022-1344 Stored XSS due to no sanitization in the filename in causefx/organizr

Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

CVE-2022-1344 Stored XSS due to no sanitization in the filename in causefx/organizr

Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

CVE-2022-1339

SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data...

CVE-2022-1339

CVE-2022-1339: Pimcore Pimcore prior to 10.3.5 is affected by SQL injection in ElementController.php, enabling unauthorized data access. Root cause: lack of input validation leading to SQL injection in Pimcore’s ElementController.php. Affected versions are before 10.3.5. Impact: potential data co...

CVE-2022-1339 SQL injection in ElementController.php in pimcore/pimcore

SQL injection in ElementController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data...

CVE-2022-0436

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2...

Path traversal

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2...

CVE-2022-1330

CVE-2022-1330 affects the fullpage.js library prior to 4.0.4. The vulnerability is a stored cross-site scripting (XSS) flaw caused by unsanitized anchor URLs in href attributes, which can allow injected JavaScript when a page uses fullpage.js. Supported sources consistently describe a stored XSS ...