Cross site scripting

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same...

CVE-2022-39207

The CVE-2022-39207 issue affects OneDev (Onedev) Build artifacts handling. It allows XSS via artifacts saved during CI/CD, served in the UI context without additional restrictions. The underlying cause is HTML content in artifacts being rendered by browsers, enabling a session-credential theft ri...

CVE-2022-39207 Persistent XSS in OneDev

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. During CI/CD builds, it is possible to save build artifacts for later retrieval. They can be accessed through OneDev's web UI after the successful run of a build. These artifact files are served by the webserver in the same...

CVE-2022-39799

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user...

PT-2022-24493 · Genymotion · Genymotion Desktop

Name of the Vulnerable Software and Affected Versions: Genymotion Desktop version 3.2.1 Description: The issue allows attackers to escalate privileges and execute arbitrary code via a crafted binary, leveraging a DLL hijacking vulnerability. Recommendations: For Genymotion Desktop version 3.2.1,...

Cross site scripting

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/mediationsecurevault/properties/ajaxprocessor.jsp via the name parameter. Session hijacking or similar attacks would not be...

CVE-2022-39810

An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting XSS vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be...

CVE-2022-39810

CVE-2022-39810 affects WSO2 Enterprise Integrator 6.4.0. It is a Reflected Cross-Site Scripting (XSS) vulnerability in the Management Console at /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. The issue could enable manipulation through the vulnerable input; the...

CVE-2022-39846

DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.220833 allows attacker to execute arbitrary code...

CVE-2022-39846

DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.220833 allows attacker to execute arbitrary code...

CVE-2022-39846

DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.220833 allows attacker to execute arbitrary code...

CVE-2022-36870

Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

CVE-2022-36871

Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

CVE-2022-36872

Pending Intent hijacking vulnerability in SpayNotification in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

CVE-2022-36871

Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

Design/Logic Flaw

Pending Intent hijacking vulnerability in NotiCenterUtils in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

Design/Logic Flaw

Pending Intent hijacking vulnerability in MTransferNotificationManager in Samsung Pay prior to version 5.0.63 for KR and 5.1.47 for Global allows attackers to access files without permission via implicit Intent...

Code injection

DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.220833 allows attacker to execute arbitrary code...

CVE-2022-36872

The CVE-2022-36872 entry describes a Pending Intent hijacking vulnerability in Samsung Pay’s SpayNotification component. Affected are Samsung Pay versions prior to 5.0.63 for Korea and prior to 5.1.47 for Global, where an attacker could access files without permission by exploiting an implicit In...

CVE-2022-36871

The CVE-2022-36871 issue affects Samsung Pay NotiCenterUtils and is a Pending Intent hijacking vulnerability that could allow an attacker to access files without permission via implicit Intent. Affected versions are Samsung Pay prior to 5.0.63 for Korea and prior to 5.1.47 for Global. The root ca...