6876 matches found
CVE-2021-41161
CVE-2021-41161 affects Combodo iTop prior to 3.0.0-beta6. The export CSV page does not properly escape user-supplied parameters, allowing JavaScript injection into rendered CSV files. Upgrading to 3.0.0-beta6 or later is advised (as reflected by multiple connected sources incl. Red Hat). There ar...
CVE-2021-41161 XSS in csvimport in 3.0.0-beta versions
Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue...
PT-2022-11368 · Comodo +1 · Combodo Itop +1
Name of the Vulnerable Software and Affected Versions: Combodo iTop versions prior to 3.0.0-beta6 Description: The issue affects Combodo iTop, a web-based IT Service Management tool. In the affected versions, the export CSV page does not properly escape user-supplied parameters, allowing for...
CVE-2021-41161: Improper Neutralization of Input During Web Page Generation
Combodo iTop is a web based IT Service Management tool. In versions prior to 3.0.0-beta6 the export CSV page don't properly escape the user supplied parameters, allowing for javascript injection into rendered csv files. Users are advised to upgrade. There are no known workarounds for this issue...
Combodo iTop cross-site scripting vulnerability
Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management and problem management. A security vulnerability exists in Combodo iTop that allows...
CVE-2022-24864 Malicious Javascript injection in OriginProtocol/origin-website
Origin Protocol is a blockchain based project. The Origin Protocol project website allows for malicious users to inject malicious Javascript via a POST request to /presale/join. User-controlled data is passed with no sanitization to SendGrid and injected into an email that is delivered to the...
Origin Protocol Cross-Site Scripting Vulnerability
Origin Protocol is an ethereum-based platform from US-based Origin that aims to bring irreplaceable tokens NFT and decentralized finance DeFi to the masses. A security vulnerability exists in Origin Protocol that allows an attacker to inject malicious Javascript code into /presale/join via a POST...
CVE-2022-21145
A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2022-21145
A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2021-43288
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...
Design/Logic Flaw
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...
PT-2022-11813
Name of the Vulnerable Software and Affected Versions ThoughtWorks GoCD versions prior to 21.3.0 Description An issue was discovered where an attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report. Recommendations For versions prior to 21.3.0, update to versio...
CVE-2021-43288: Improper Neutralization of Input During Web Page Generation
An issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker in control of a GoCD Agent can plant malicious JavaScript into a failed Job Report...
CVE-2022-0840
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...
CVE-2022-0840
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...
Design/Logic Flaw
The Easy Social Icons WordPress plugin before 3.2.1 does not properly escape the imagefile field when adding a new social icon, allowing high privileged users to inject arbitrary javascript even when the unfilteredhtml capability is disallowed...
CVE-2022-0840
The vulnerability is in the WordPress Easy Social Icons plugin (versions before 3.2.1). The image_file field is not properly escaped when adding a new social icon, enabling stored cross-site scripting. High-privilege users can inject arbitrary JavaScript even when unfiltered_html is disallowed. T...
CVE-2022-24229
The CVE-2022-24229 entry describes an XSS vulnerability in ONLYOFFICE Document Server Example prior to version 7.0.0. The affected component/path is the example editor endpoint (/example/editor), allowing remote attackers to inject arbitrary HTML or JavaScript. The issue is tied to an external we...