Check MK 2.0.x < 2.0.0p20 XSS Vulnerability

Check MK is prone to a cross-site scripting XSS vulnerability in custom user attributes. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-44CG-QCPR-FWJH Cross site scripting in francoisjacquet/rosariosis

A Cross Site Scripting XSS vulnerabilty exits in RosarioSIS before 7.6.1 via the xssclean function in classes/Security.php, which allows remote malicious users to inject arbitrary JaveScript of HTML.An example of affected components are all Markdown input fields...

CVE-2021-43943

CVE-2021-43943 affects Atlassian Jira Service Management Server and Data Center. Affected component: InsightDefaultCustomFieldConfig.jspa, in the /secure/admin/InsightDefaultCustomFieldConfig.jspa page, where an HTML/JavaScript payload can be injected via the Object Schema field due to insufficie...

TikTok: HTML Injection via Email Share

A HTML injection was found on a TikTok endpoint via the "nameofowner" parameter. We thank @lu3ky-13 for reporting this to our team...

Checkmk Cross-Site Scripting Vulnerability (CNVD-2022-21231)

Checkmk is an editor. A cross-site scripting vulnerability exists in Checkmk, which stems from Checkmk version = 2.0.0p19. When creating or editing user properties, Help Text is affected by HTML injection, which can be triggered when editing a user. An attacker could use this vulnerability to...

CVE-2022-24564

Checkmk =2.0.0p19 contains a Cross Site Scripting XSS vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user...

CVE-2022-24564

Checkmk =2.0.0p19 contains a Cross Site Scripting XSS vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user...

CVE-2022-24564

Checkmk =2.0.0p19 contains a Cross Site Scripting XSS vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user...

Cross site scripting

Checkmk =2.0.0p19 contains a Cross Site Scripting XSS vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user...

CVE-2022-24564

Affected product: Checkmk. Vulnerability: Cross-Site Scripting (XSS) in the Help Text when creating or editing a user attribute, due to HTML injection in the user attribute editing flow. Root cause: HTML injection in the Help Text field (user attributes). Impact: client-side code execution potent...

CVE-2022-24564

Checkmk =2.0.0p19 contains a Cross Site Scripting XSS vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user...

CVE-2022-24564

Checkmk =2.0.0p19 contains a Cross Site Scripting XSS vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user...

Checkmk 跨站脚本漏洞

Checkmk is an editor. A cross-site scripting vulnerability exists in Checkmk, which stems from Checkmk version = 2.0.0p19. When creating or editing user properties, Help Text is affected by HTML injection, which can be triggered when editing a user. An attacker could use this vulnerability to...

GO-2021-0239 Improper sanitization when resolving values from DNS in net

The LookupCNAME, LookupSRV, LookupMX, LookupNS, and LookupAddr functions and their respective methods on the Resolver type may return arbitrary values retrieved from DNS which do not follow the established RFC 1035 rules for domain names. If these names are used without further sanitization, for...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php...

CVE-2022-24981

CVE-2022-24981 describes a reflected XSS in forms generated by JQueryForm.com prior to 2022-02-05. The vulnerability is triggered via the redirect parameter to admin.php, allowing remote attackers to inject arbitrary web script or HTML. Documents consistently identify the affected component as th...

SecurityScorecard: HTML injection through Invite Teammate email

Summary: I found HTML injection on domain https://platform.securityscorecard.io/ when we send invite teammate email. In this case "message" parameter is vulnerable. Steps To Reproduce: 1. Go to page https://platform.securityscorecard.io/ and login. 2. Now go to page...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters...

GitLab: Stored XSS in Notes (with CSP bypass for gitlab.com)

Summary I read the issue 345657 which handles the XSS in notes reported in Hackerone report 1398305. This issue fixes the reported XSS but leaves the HTML injection that was also mentioned. I don't know how you deal with these situations, but I thought I report this, and you can decide : The issu...

CVE-2020-13673

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to...