CVE-2022-23620

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

CVE-2022-23620 Path traversal in xwiki-platform-skin-skinx

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

CVE-2022-23620 Path traversal in xwiki-platform-skin-skinx

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

CVE-2022-23620: Improper Limitation of a Pathname to a Restricted Directory

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions AbstractSxExportURLFactoryActionHandlerprocessSx does not escape anything from SSX document references when serializing it on filesystem, it is possible to for the HTML...

PT-2022-16134 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.6-rc-1 Description: The issue arises from the AbstractSxExportURLFactoryActionHandlerprocessSx function not properly escaping SSX document references when serializing them on the filesystem. This allows the...

CVE-2020-7776

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is...

Headless, Unattended Scanning in Burp Suite Professional 2.0 with Seltzer

Burp Suite Professional Burp is one of the best tools available for penetration testers. It is feature-rich, intuitive, well-supported, and customizable. However, it can be difficult to use Burp for headless, unattended scanning. Alternatives such as Burp Suite Enterprise exist, but those of us...

WS-2015-0070

In OpenRefine, versions 2.0 through 2.6-rc2 are vulnerable to Cross-Site Scripting, due to the ‘&' ampersand character not escaped when exporting cell values to HTML. An attacker could enter a crafted cell value to trigger arbitrary javascript code on a victim’s browser...

CVE-2014-3948

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3948

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3948

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-3948

CVE-2014-3948 applies to the TYPO3 powermail extension. The HTML export wizard in the powermail backend module is affected by a cross-site scripting (XSS) vulnerability in versions up to 1.6.10, allowing remote attackers to inject arbitrary script via unspecified vectors. A fixed release is 1.6.1...

PT-2014-5628

Name of the Vulnerable Software and Affected Versions TYPO3 powermail extension versions prior to 1.6.11 Description A cross-site scripting XSS issue exists in the HTML export wizard of the powermail extension's backend module, allowing remote attackers to inject arbitrary web script or HTML...

CVE-2014-3948: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Arbitrary code execution in extension "powermail" (powermail)

It has been discovered that the extension "powermail" powermail is susceptible to arbitrary code execution and Cross-Site Scripting Release Date: May 22, 2014 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: powermail:...

Arbitrary file creation in AbstractRendererExporterImpl

To reproduce: 1. Create a new space. 2. Create a new page. 3. Attach a file called test.txt to the page. 3. Edit the page, and add an image with the URL: code /confluence/s/download/attachments/pageid//../../../../../../../../../../../../tmp/test.txt code \pageid\ must be replaced with the actual...

[WS_FTP Password Decryptor] Recover FTP login passwords stored by WS_FTP

WSFTP Password Decryptor is the FREE software to instantly recover FTP login passwords stored by WSFTP - one of the popular FTP client application. WSFTP stores the password for all the past FTP sessions in the "wsftp.ini" file so that user don't have to enter it every time. WSFTP Password...

[WiFi Password Decryptor] Free Wireless Password Recovery Software

| WiFi Password Decryptor is the FREE software to instantly recover Wireless account passwords stored on your system. --- It automatically recovers all type of Wireless Keys/Passwords WEP/WPA/WPA2 etc stored by Windows Wireless Configuration Manager. For each recovered WiFi account, it displays...

CVE-2012-3217

Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7.0 allows context-dependent attackers to affect availability, related to Outside In HTML Export SDK...