UBUNTU-CVE-2024-36123

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page MediaWiki:Tagline has its contents used unescaped, so custom HTML including Javascript can be injected by someone with the ability to edit the MediaWiki namespace typically those with the editinterface...

PT-2024-26910

Name of the Vulnerable Software and Affected Versions Citizen versions prior to 2.16.0 Description The Citizen MediaWiki skin is affected by an issue where the page MediaWiki:Tagline has its contents used unescaped, allowing custom HTML including Javascript to be injected by someone with the...

PT-2024-22575

Name of the Vulnerable Software and Affected Versions IBM Engineering Workflow Management versions 7.0.2 through 7.0.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within ...

PT-2024-40096 · Microsoft · Internet Explorer

Name of the Vulnerable Software and Affected Versions: Silverstripe versions prior to a fixed version affected versions not specified Description: The issue affects Internet Explorer browsers, where requests do not encode all entities in the URL string. As a result, when rewriting hashlinks,...

PT-2024-40151

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue allows a bad actor with access to the CMS to embed malicious javascript using onmouseover or onmouseout attributes in the WYSIWYG editor. Recommendations: At the moment, there...

CVE-2024-34710

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection ...

PT-2024-26125

Name of the Vulnerable Software and Affected Versions Wiki.js versions prior to 2.5.303 Description A client-side template injection issue was discovered in Wiki.js, a wiki app built on Node.js. This issue could allow an attacker to inject malicious JavaScript into the content section of pages,...

Wiki.js 安全漏洞

Wiki.js is a suite of open source Wiki software from the Requarks.io team based on Node.js and written in the JavaScript language. A security vulnerability exists in Wiki.js versions prior to 2.5.303, which stems from a vulnerability that allows an attacker to inject malicious JavaScript into the...

CVE-2024-34710: Improper Neutralization of Special Elements Used in a Template Engine

Wiki.js is al wiki app built on Node.js. Client side template injection was discovered, that could allow an attacker to inject malicious JavaScript into the content section of pages that would execute once a victim loads the page that contains the payload. This was possible through the injection ...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server ABAP Platform, which stems from a lack of input validation and output encoding of untrusted data, and can be exploited by an unauthenticated...

CVE-2024-32733: Improper Neutralization of Input During Web Page Generation

Due to missing input validation and output encoding of untrusted data, SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject malicious JavaScript code into the dynamically crafted web page. On successful exploitation the attacker can access or modify...

PT-2024-25692 · Mantisbt · Mantisbt

Name of the Vulnerable Software and Affected Versions: MantisBT versions prior to 2.26.2 Description: The issue is related to improper escaping of a custom field's name, allowing an attacker to inject HTML and potentially execute arbitrary JavaScript when certain conditions are met, such as...

New Case Study: The Malicious Comment

How safe is your comments section? Discover how a seemingly innocent 'thank you' comment on a product page concealed a malicious vulnerability, underscoring the necessity of robust security measures. Read the full real-life case study here. When is a 'Thank you' not a 'Thank you'? When it's a...

CVE-2024-28979

Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2024-28979

Dell OpenManage Enterprise, versions 4.1.0 and older, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection...

CVE-2024-28979

Dell OpenManage Enterprise (Dell EMC) before 4.1.0 is affected by an improper neutralization of input during web page generation (Cross-site Scripting). The vulnerability arises from insufficient input filtering/escaping in the web UI, enabling a high-privilege remote attacker to inject scripts v...

PT-2024-41445 · Ооо "Вебсофт Девелопмент" · Websoft Hcm

Уязвимость программного обеспечения автоматизации HR-процессов Websoft HCM связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, провести атаку межсайтового скриптинга XSS путём внедрения специально сформированного...

CVE-2024-4302: Improper Neutralization of Input During Web Page Generation

Super 8 Live Chat online customer service platform fails to properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. When the message recipient views the message, they become susceptible to Cross-site Scripting XSS attacks...

PT-2024-30256 · Unknown · Super 8 Live Chat

Name of the Vulnerable Software and Affected Versions: Super 8 Live Chat affected versions not specified Description: The issue allows unauthenticated remote attackers to insert JavaScript code into the chat box due to a failure to properly filter user input. When the message recipient views the...

PT-2024-5162

Name of the Vulnerable Software and Affected Versions: Sidekiq versions prior to 7.2.4 Description: The issue is related to a reflected XSS vulnerability in Sidekiq, where the value of the substr parameter is reflected in the response without any encoding, allowing an attacker to inject Javascrip...