Cross site scripting

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

CVE-2021-43409 WPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scripting

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

Judge.me : Stored XSS in "product type" field executed via product filters

HI @judgeme! I found Stored XSS! I Install judge.me in Shopify E-Commerce. Step to reproduce: 1. Log in to our shopify dev store and install "judgeme" app. 2. Create random product in our Shopify store make it active and insert XSS playload " in "PRODUCT TYPE" field and SAVE F1518888 3. Then go t...

CVE-2021-43017 Adobe Creative Cloud DLL Hijacking Local Application Denial of Service

Adobe Creative Cloud version 5.5 and earlier are affected by an Application denial of service vulnerability in the Creative Cloud Desktop installer. An authenticated attacker with root privileges could leverage this vulnerability to achieve denial of service by planting a malicious file on the...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a Kubernetes API server security vulnerability (CVE-2021-25737)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in the Kubernetes API server that could allow a user to redirect pod traffic to private networks on a node CVE-2021-25737. Vulnerability Details CVEID: CVE-2021-25737 Description: Kubernetes could allow a remote...

In uClibc and uClibc-ng before 1.0.39 incorrect handling of special characters in domain names returned by DNS servers via gethostbyname getaddrinfo gethostbyaddr and getnameinfo can lead to output of wrong hostnames (leading to domain hijacking) or injection into applications (leading to remote code execution XSS applications crashes etc.). In other words a validation step which is expected in any stub resolver does not occur.

...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2021-2776)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.9.1 : c-ares (EulerOS-SA-2021-2737)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can...

McAfee Drive Encryption < 7.3.0 HF2 DLL Hijacking (SB10374)

The remote host is running a version of McAfee Drive Encryption prior to 7.3.0 HF2. It is, therefore, affected by a DLL search order hijacking vulnerability that allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder. Note that Nessus has not...

EulerOS Virtualization 2.9.0 : c-ares (EulerOS-SA-2021-2776)

According to the versions of the c-ares package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS Domain Name Servers can...

CVE-2021-25940

In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable to Insufficient Session Expiration. When a user’s password is changed by the administrator, the session isn’t invalidated, allowing a malicious user to still be logged in and perform arbitrary actions within the system...

Mozilla Firefox Security Advisory (MFSA2012-98) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

CVE-2021-42703

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

CVE-2021-42703 AzeoTech DAQFactory

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

CVE-2021-42703

Vulnerability context: CVE-2021-42703 corresponds to a cross‑site scripting flaw in Advantech WebAccess HMI Designer (pre‑2.1.11.0). The issue stems from insufficient input filtering/escaping of user‑submitted parameters, enabling attacker‑supplied JavaScript to execute in the affected web contex...

McAfee Drive Encryption DLL hijacking vulnerability

Mcafee McAfee Drive Encryption is a full-disk encryption software from Mcafee that helps protect data on Microsoft Windows tablets, laptops, and desktop PCs from sensitive data loss, especially from lost or stolen devices. mcafee Drive Encryption MDE version 7.3.0 HF2 7.3.0.183 prior to this...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2021-2652)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for c-ares (EulerOS-SA-2021-2679)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mozilla Firefox Security Advisory (MFSA2013-74) - Linux

This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

JetBrains YouTrack has an unspecified vulnerability (CNVD-2021-91661)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. The software has features such as bug tracking, creating workflows and monitoring project progress.JetBrains YouTrack Mobile 2021.2 previously had a security vulnerability that could ...