Cross site scripting in reveal.js

The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute...

GHSA-HHQJ-CFJX-VJ25 Cross site scripting in reveal.js

The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute...

Ice Hrm Cross-Site Scripting Vulnerability (CNVD-2022-67478)

Ice Hrm is a human resource management system. Ice Hrm version 30.0.0.OS is vulnerable to a cross-site scripting vulnerability that stems from a lack of checksum filtering of user-supplied data and output data in the key and fm parameters in the component login.php. An attacker could exploit this...

Hospital Management System Cross-Site Scripting Vulnerability (CNVD-2022-67484)

HealthNode Hospital Management System is a hospital management system. The system includes patient information management, ward management, surgery schedule management and financial management, etc. A cross-site scripting vulnerability exists in Hospital Management System v1.0, which stems from t...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2022-71111)

CMS Made Simple is a content management system CMS. The system supports a role-based permission management system, a wizard-based installation and update mechanism, an intelligent caching mechanism, etc. A cross-site scripting vulnerability exists in CMS Made Simple v2.2.15, which stems from the...

Maxsite CMS Cross-Site Scripting Vulnerability (CNVD-2022-33827)

MaxSite CMS is a web content management system of the Russian MaxSite CMS open source project.Maxsite CMS has a cross-site scripting vulnerability , the vulnerability stems from the lack of parameters in the management file f the user-supplied data and output data validation filter , an attacker...

WordPress Crazy Bone plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability in WordPress Crazy Bone plugin 0.6.0 and earlier versions, which stems fr...

Home Owners Collection Management System Cross-Site Scripting Vulnerability

Home Owners Collection Management System is a homeowner collection management system. v1.0 of Home Owners Collection Management System is vulnerable to a cross-site scripting vulnerability that originates from a lack of filtering of user-supplied data and output data via the collect by parameter...

Ice Hrm Cross-Site Scripting Vulnerability (CNVD-2022-67479)

Ice Hrm is a human resource management system. Ice Hrm version 30.0.0.OS is vulnerable to a cross-site scripting vulnerability caused by a lack of data validation filtering of user-supplied and output data in the "m" parameter of the user dashboard. An attacker could exploit this vulnerability to...

CVE-2021-46387

CVE-2021-46387 affects ZyXEL ZyWALL 2 Plus Internet Security Appliance. The issue is a Cross-Site Scripting (XSS) vulnerability caused by insecure URI handling, enabling an attacker to execute arbitrary JavaScript in a user’s browser and potentially perform clipboard hijacking or session hijackin...

Cross-site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to invalid input validation in the detectXss function in the Security.php file which allows remote attackers to inject and execute arbitrary javascript code in the victim's browser...

JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2022-20142)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. A cross-site scripting vulnerability exists in previous versions of JetBrains YouTrack 2021.4.36872, which stems from the lack of data validation filtering of user-supplied data and...

JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2022-20143)

JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. A cross-site scripting vulnerability exists in versions prior to JetBrains YouTrack 2021.4.31698, which stems from a lack of data validation filtering of user-supplied data and output...

PT-2022-13430

Name of the Vulnerable Software and Affected Versions hakimel/reveal.js versions prior to 4.3.0 Description The issue is related to Cross-site Scripting XSS - DOM. Specifically, the onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding...

BloofoxCms Cross-Site Scripting Vulnerability (CNVD-2022-17027)

BloofoxCms is a Php-based text content management system from alexlang24 personal developer. bloofoxCMS suffers from a cross-site scripting vulnerability that stems from the lack of user-supplied data and output data validation filtering in the file and type parameters in index.php. An attacker...

WordPress Survey Maker plugin跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WordPress plugin is a WordPress open source application plugin. WordPress Survey Maker plugin 2.0.6 and previous versions have a cross-site scripting vulnerability, which can be exploited by attacke...

Security Bulletin: WebSphere Application Server Liberty vulnerabilities affect IBM Spectrum Control (formerly Tivoli Storage Productivity Center) (CVE-2019-4663 and CVE-2019-4720)

Summary Security vulnerabilities in IBM WebSphere Application Server Liberty affect IBM Spectrum Control formerly Tivoli Storage Productivity Center. IBM Spectrum Control has addressed the following CVEs. Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0...

WordPress PowerPack Lite for Beaver Builder plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the WordPress PowerPack Lite for Beaver Builder plugin...

Cross-site Scripting (XSS) - Stored in librenms/librenms

Description Stored XSS in create/modify Transport Groups, Add/Edit Service and Edit Service Template Proof of Concept Payload: ' PoC image: Xss payload in create/modify Transport Groups Xss payload in Add/Edit Service Xss payload in Edit Service Template XSS will fire-up by user visiting: 1...

XWiki Platform Cross-Site Scripting Vulnerability (CNVD-2022-13407)

Xwiki Platform is a wiki platform for creating web collaboration applications from the French company Xwiki. XWiki Platform is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output in registerinline, which could be...