Turnitin LTI 跨站脚本漏洞

Turnitin LTI is the modern standard for integrating third-party tools with virtual learning environments. A security vulnerability exists in Turnitin LTI version 1.3 that stems from the vulnerability of the Submission Web Form to HTML injection attacks...

GitLab 7.14 < 15.11.10 / 16.0 < 16.0.6 / 16.1 < 16.1.1 (CVE-2023-2200)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1,...

CVE-2023-37255

CVE-2023-37255 concerns the MediaWiki CheckUser extension (up to 1.39.3). In Special:CheckUser, the check of type “get edits” is vulnerable to HTML injection via the User-Agent HTTP header . The vulnerability’s impact is limited to scenarios where user-supplied User-Agent data influences the HTML...

CVE-2023-34831

The CVE-2023-34831 entry affects Turnitin LTI tool/plugin version 1.3, specifically the Submission Web Form. The vulnerability is HTML Injection via the id and title HTTP POST parameters used when students submit reports for similarity checks. Connected sources corroborate this HTML injection iss...

PT-2023-25858 · Mediawiki +1 · Checkuser Extension +1

Name of the Vulnerable Software and Affected Versions: CheckUser extension for MediaWiki versions through 1.39.3 Description: An issue in the CheckUser extension for MediaWiki allows HTML injection through the User-Agent HTTP request header in Special:CheckUser when performing a "get edits" type...

PT-2023-25018 · Turnitin · Turnitin Lti Tool

Name of the Vulnerable Software and Affected Versions: Turnitin LTI tool/plugin version 1.3 Description: The issue affects the "Submission Web Form" of the Turnitin LTI tool/plugin, where students submit their reports for similarity/plagiarism checks. Specifically, the submission web form is...

CVE-2023-37255

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML injection through the User-Agent HTTP request header...

CVE-2023-34831

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...

CVE-2023-34831

The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...

CVE-2023-37255

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML injection through the User-Agent HTTP request header...

Gitlab -- Vulnerabilities

Gitlab reports: ReDoS via EpicReferenceFilter in any Markdown fields New commits to private projects visible in forks created while project was public New commits to private projects visible in forks created while project was public Maintainer can leak masked webhook secrets by manipulating URL...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to html injection due to [CVE-2023-24539]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to html injection. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24539 Vulnerability Details CVEID:CVE-2023-24539 DESCRIPTION: Go is vulnerable to...

Security Bulletin: IBM App Connect Enterprise Certified Container operands and operator may be vulnerable to HTML injection due to [CVE-2023-24540]

Summary IBM App Connect Enterprise Certified Container operator and operands may be vulnerable to HTML injection. This bulletin provides patch information to address the reported vulnerability in Golang Go. CVE-2023-24540 Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Go is vulnerable to...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to HTML injection (CVE-2023-27864)

Summary IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to HTML injection. Vulnerability Details CVEID:CVE-2023-27864 DESCRIPTION: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which...

Active Matrimonial CMS 1.6 HTML Injection

==================================================================================================================================== | Title : Active Matrimonial CMS v 1.6 HTML inject Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 64.0.2...

Improper Input Validation

craftcms/redactor, is vulnerable to Improper Input Validation. The vulnerability exists because the html is not properly validated which allows an attacker to inject payloads via HTML Injection...

Trend Micro Apex Central 跨站脚本漏洞

Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. A cross-site scripting vulnerability exists in Trend Micro Apex Central, which can be exploited by an attacker to inject malicious script or HTML code...

Trend Micro Apex Central 跨站脚本漏洞

Trend Micro Apex Central is a Web-based console from Trend Micro, Inc. A cross-site scripting vulnerability exists in Trend Micro Apex Central, which can be exploited by an attacker to inject malicious script or HTML code...

Membership Plugin - Restrict Content < 3.2.3 - Reflected XSS

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged-in admin open a page containing the HTML code below. "/...

Active Matrimonial CMS 1.5 HTML Injection

==================================================================================================================================== | Title : Active Matrimonial CMS v 1.5 HTML inject Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 64.0.2...