CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

DEBIAN-CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure...

CVE-2021-3694

LedgerSMB has a vulnerability where error messages were not sufficiently HTML-encoded, allowing an authenticated user to exploit a specially crafted URL to trigger remote code execution and information disclosure. The issue is documented across multiple advisories (CVE-2021-3694 and related CVEs)...

PT-2021-21414 · Ledgersmb +2 · Ledgersmb +2

Name of the Vulnerable Software and Affected Versions: LedgerSMB affected versions not specified Description: The issue arises from insufficient HTML-encoding of error messages sent to the browser. This can be exploited by sending a specially crafted URL to an authenticated user, potentially...

PT-2021-4174 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 7.6.53 ELTS TYPO3 versions prior to 8.7.42 ELTS TYPO3 versions prior to 9.5.29 TYPO3 versions prior to 10.4.19 TYPO3 versions prior to 11.3.2 Description: The content rendering process in the website frontend is...

FetLife: Specific Payload makes a Users Posts unavailable

Good Morning, Like we talked about in the email, I'm reporting an issue that I've found that is possible, by crafting a specific payload, other users that try to access /posts of a user will face the 500 Internal Server Error issue, not only when they access the specific crafted post. With this,...

Acronis: Reflected Cross Site Scripting at ColdFusion Debugging Panel http://www.grouplogic.com/CFIDE/debug/cf_debugFr.cfm

Summary The ColdFusion Debugging Panel exposed at below URL. http://www.grouplogic.com/CFIDE/debug/cfdebugFr.cfm?userPage= The userPage parameter is not properly sanitized and is displayed without proper output encoding. This results in reflected cross site scripting. Steps To Reproduce Enter any...

GHSA-FPQV-X9HM-35J9 Cross-site Scripting vulnerability in Kitodo.Presentation

Impact Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting XSS. Only sites using the ListView, Navigation or PageView plugins are affected. It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site...

Cross-site Scripting vulnerability in Kitodo.Presentation

Impact Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting XSS. Only sites using the ListView, Navigation or PageView plugins are affected. It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site...

Cross-Site Scripting in extension "Google reCAPTCHA (v2/v3)" (jh_captcha)

The extension fails to properly encode user input for output in HTML context. The issue is only exploitable by backend users with access to TypoScript settings of the extension...

Starbucks: Cross-Site Scripting (XSS) on www.starbucks.com | .co.uk login pages

Hi team, Summary: There is a cross-site scripting vulnerability on the login page of www.starbucks.com and various regions, due to improper escaping on the URL path. Description: The login page at https://www.starbucks.com/account/signin builds several links by the relative URL path. An attacker...

Glassdoor: [XSS] Reflected XSS via POST request in (editJobAlert.htm) file

Description: first, it was a very good bug for me it starts when I was testing the form for I found a CSRF I sent it here 838778 I tested the form again and after few minutes I found that this parameter locationId in the post request is vulnerable to XSS the page take the value of this parameter...

Parallels Plesk Panel 9.5 Cross Site Scripting

Exploit Title: Parallels Plesk Panel 9.5 Reflected XSS Release Date: 06/11/2019 Author: Cyber Citadel Website: www.cybercitadel.com Vendor: www.plesk.com Versions 9.5 Description A Cross Site Scripting vulnerability occurs when an attacker can inject JavaScript in context of the web application...

Cross-Site Scripting (XSS)

com.liferay.journal.taglib is vulnerable to cross-site scripting XSS. Lack of HTML encoding allows a remote attacker to inject arbitrary Javascript into a victim's browser via the title of the journal...

Ping Identity Agentless Integration Kit Cross Site Scripting

Ping Identity Agentless Integration Kit Reflected Cross-site Scripting XSS Link: https://github.com/sbaresearch/advisories/tree/public/2019/SBA-ADV-20190305-01PingIdentityAgentlessIntegrationKitReflectedXSS Vulnerability Overview Ping Identity Agentless Integration Kit before 1.5 is susceptible t...

Snapforce CRM 8.3.0 Cross Site Scripting

Hello Team, Greetings. there is list of xss vulnerabilities and Concurrent login vulnerabilities are in snapforce version 8.3.0 application. Vulnerability List: 1. Stored Cross Site Scripting 2. Stored Cross Site Scripting thorough UI Redirection. 3 Concurrent Login are Allowed Effected URL:...

Cross-Site Scripting

Overview Versions of keystone prior to 4.0.0 are vulnerable to Cross-Site Scripting XSS. The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having...

Cross-Site Scripting (XSS)

bodhi-server is vulnerable to cross-site scripting XSS. The bug title is not sanitized and HTML encoded before displaying on the user's browser, which would allow a remote attacker to inject arbitrary Javascript into the victim's browser to steal session tokens or perform unwanted actions on beha...