CVE-2022-40257

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...

CVE-2022-40248

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field...

CVE-2022-40257

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...

Design/Logic Flaw

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field...

Design/Logic Flaw

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...

CVE-2022-40248 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field...

PT-2022-5025 · Unknown · Cert/Cc Vince

Name of the Vulnerable Software and Affected Versions: CERT/CC VINCE versions prior to 1.50.4 Description: An HTML injection issue exists, allowing an authenticated attacker to inject arbitrary HTML via a form using the Product Affected field. This can be exploited by a remote attacker...

CVE-2022-40248

CERT/CC VINCE is affected by an HTML injection vulnerability in versions prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via the Product Affected field in a form, potentially impacting data or UI integrity. The vulnerability has been consistently described across multiple sou...

VINCE 跨站脚本漏洞

VINCE is a CERT Coordination Center in the United States CERT Coordination Center open source a CERT Coordination Center development and use of vulnerability information and coordination environment. Vulnerability disclosure for improved coordination. A cross-site scripting vulnerability exists i...

CVE-2022-40257

CVE-2022-40257 affects CERT/CC VINCE software prior to v1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML in the Subject field due to insufficient HTML sanitization. The vulnerability enables HTML injection in VINCE’s handling of email subjects, with CVSS v...

PT-2022-5026 · Unknown · Cert/Cc Vince

Name of the Vulnerable Software and Affected Versions: CERT/CC VINCE versions prior to 1.50.4 Description: An HTML injection issue exists due to the failure to neutralize special elements. This allows a remote attacker to inject arbitrary HTML code via a crafted email with HTML content in the...

CVE-2022-40257 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...

VINCE 跨站脚本漏洞

VINCE is a CERT Coordination Center in the United States CERT Coordination Center open source a CERT Coordination Center development and use of vulnerability information and coordination environment. Vulnerability disclosure for improved coordination. A cross-site scripting vulnerability exists i...

CVE-2022-40248 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Product Affected" field...

CVE-2022-40257 An HTML injection vulnerability exists in CERT/CC VINCE software prior to version 1.50.4

An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with HTML content in the Subject field...

CVE-2022-39270

DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories and have sufficient trust level - configured in component's settings are able to inject arbitrary HTML on that topic's page. The issue has been fixed on th...

Cross site scripting

A cross-site scripting XSS vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the ServiceTemplates servicealias parameter...

Code injection

DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories and have sufficient trust level - configured in component's settings are able to inject arbitrary HTML on that topic's page. The issue has been fixed on th...

CVE-2022-39270

CVE-2022-39270 affects the DiscoTOC Discourse theme component. The vulnerability arises from lack of escaping/filtering of input data on pages that can create topics in toC-enabled categories, allowing users with topic-creation rights and sufficient trust level to inject arbitrary HTML on the top...

PT-2022-24858 · Discotoc · Discotoc

Name of the Vulnerable Software and Affected Versions: DiscoTOC versions prior to the fixed version on the main branch Description: The issue allows users to inject arbitrary HTML on a topic's page if they can create topics in TOC-enabled categories and have a sufficient trust level. The estimate...