CVE-2018-14380: Improper Neutralization of Input During Web Page Generation

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

PT-2018-12478

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 2.4.6 Description The issue allows for XSS in typeahead components. This is related to the components/common/TypeAheadInput.jsx and components/search/QueryInput.ts files. Recommendations For versions prior to 2.4.6,...

THRecon - Threat Hunting Reconnaissance Toolkit

Collect endpoint information for use in incident response triage / threat hunting / live forensics using this toolkit. When a security alert raises concern over a managed system, this toolkit aims to empower the analyst with as much relevant information as possible to help determine if a compromi...

Graylog Cross-Site Scripting Vulnerability

Graylog is an open source log storage system , it supports the system log syslog saved to MongoDB distributed document storage database. A cross-site scripting vulnerability exists in notifications in Graylog versions prior to 2.4.4. A remote attacker can exploit this vulnerability to inject...

Graylog cross-site scripting vulnerability (CNVD-2018-11028)

Graylog is an open source log storage system , it supports the system log syslog saved to MongoDB distributed document storage database. A cross-site scripting vulnerability exists in the dashboard name in versions of Graylog prior to 2.4.4. A remote attacker can exploit this vulnerability to...

Cross site scripting

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11651

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

CVE-2018-11651

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

Cross site scripting

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11651

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0, <=1.0.1) +8 more potentially affected by CVE-2018-11650 via org.graylog2:graylog2-server (>=1.0.0-beta.3, <=2.4.3)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.0.0, =1.0.2, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.0.3, =1.0.0-beta.2, =1.2.0-rc.1, =1.3.4 Source cves: CVE-2018-11650 Source advisory: MEND:CVE-2018-11650...

CVE-2018-11651

Graylog before v2.4.4 is affected by an XSS vulnerability due to unescaped text in dashboard names, specifically in dashboard-related UI components (Dashboard.jsx, EditDashboardModal.jsx) and ShowDashboardPage.jsx. The issue enables script execution when dashboard names contain malicious content....

CVE-2018-11650

CVE-2018-11650 affects Graylog before 2.4.4, where unescaped text in notifications (util/UserNotification.js, toastr) enables a cross-site scripting (XSS) vulnerability. The issue arises in the notification output path and can allow injection of HTML/JS in user-facing notifications. Multiple conn...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11651

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

PT-2018-10731

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 2.4.4 Description The issue is related to an XSS security problem with unescaped text in notifications. This is connected to toastr and the util/UserNotification.js file. Recommendations For versions prior to 2.4.4,...

CVE-2018-11650: Improper Neutralization of Input During Web Page Generation

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...