Code injection

XWiki Platform Mentions UI is a user interface for mentioning users in wiki content for XWiki Platform, a generic wiki platform. Starting in version 12.5-rc-1 and prior to versions 13.10.6 and 14.4, it's possible to store Javascript or groovy scripts in a mention, macro anchor, or reference field...

CVE-2022-36097 XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form

XWiki Platform Attachment UI provides a macro to easily upload and select attachments for XWiki Platform, a generic wiki platform. Starting with version 14.0-rc-1 and prior to 14.4-rc-1, it's possible to store JavaScript in an attachment name, which will be executed by anyone trying to move the...

CVE-2022-36096 XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list

The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index wi...

CVE-2022-36094 XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascri...

CVE-2022-36094

CVE-2022-36094 affects XWiki Platform Web Parent POM. The issue allows storing JavaScript that is executed when anyone views the history of an attachment whose name contains javascript, for versions starting from 1.0 up to but not including 13.10.6 and 14.30-rc-1. The vulnerability is mitigated b...

CVE-2022-36094 XWiki Platform Web Parent POM vulnerable to XSS in the attachment history

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascri...

PT-2022-23186 · Unknown · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 13.10.6 and 14.3 Description: The XWiki Platform Index UI allows storing JavaScript that will be executed by anyone viewing the deleted attachments index with an attachment containing JavaScript in its name...

PT-2022-23184 · Xwiki · Xwiki +1

Name of the Vulnerable Software and Affected Versions: XWiki Platform Web Parent POM versions 1.0 through 13.10.5 XWiki Platform Web Parent POM versions 14.0-rc-1 through 14.3 Description: The issue allows storing JavaScript that will be executed by anyone viewing the history of an attachment...

CVE-2022-36094: Improper Neutralization of Input During Web Page Generation

XWiki Platform Web Parent POM contains Web resources for the XWiki platform, a generic wiki platform. Starting with version 1.0 and prior to versions 13.10.6 and 14.30-rc-1, it's possible to store JavaScript which will be executed by anyone viewing the history of an attachment containing javascri...

CVE-2022-36080: Improper Neutralization of Input During Web Page Generation

Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue...

SUSE-SU-2022:3101-1 Security update for zabbix

This update for zabbix fixes the following issues: - CVE-2022-35230: Javascript embedded in links for graphs page will be executed bsc1201290...

CVE-2022-39049

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

CVE-2022-39049

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

UBUNTU-CVE-2022-39049

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

CVE-2022-39049

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

CVE-2022-39049

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

CVE-2022-39049

CVE-2022-39049 affects OTRS. An attacker with admin privileges can manipulate the URL to execute JavaScript in the OTRS context (XSS). Affected versions include OTRS 6.0.x (Community Edition) up to 6.0.34, 7.0.x up to 7.0.46, and 8.0.x up to 8.0.36. Remediation per connected sources: upgrade to 6...

CVE-2022-39049: Improper Neutralization of Input During Web Page Generation

An attacker who is logged into OTRS as an admin user may manipulate the URL to cause execution of JavaScript in the context of OTRS...

Mozilla Thunderbird 跨站脚本漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The software supports the IMAP and POP email protocols as well as the HTML email format. Mozilla Thunderbird suffers from a cross-site scripting vulnerabilit...

The vulnerability of the Thunderbird email client, related to errors in processing input data, allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the Thunderbird email client is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code by sending a specially crafted HTML email with a meta tag set to “refresh”...