CVE-2021-44042

An issue was discovered in UiPath Assistant 21.4.4. User-controlled data supplied to the --process-start argument of the URI handler for uipath-assistant:// is not correctly encoded, resulting in attacker-controlled content being injected into the error message displayed when the injected content...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. real WYSIWYG plugin is a WordPress open source application plugin. the WordPress Real WYSIWYG plugin has a security...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WP System Log plugin is a WordPress open source application plugin. WordPress WP System Log plugin in versions pri...

MGASA-2021-0554 Updated thunderbird packages fix security vulnerability

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities CVE-2021-43528. Under certain...

Remote Code Execution (RCE)

thunderbird is vulnerable to remote code execution. The vulnerability exists due to the lack of sanitization of the execution context which allows Javascript to be enabled in the composition area...

Free School Management Software 1.0 - Remote Code Execution Vulnerability

Exploit Title: Free School Management Software 1.0 - Remote Code Execution RCE Exploit Author: fuuzap1 Category: Web application Vendor Homepage: https://www.sourcecodester.com/php/15073/free-school-management-software.html Software Link:...

Cross site scripting

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/siteaccess/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution...

CVE-2021-20137

Gryphon Tower router web interface is affected by a reflected XSS in the URL parameter of /cgi-bin/luci/site_access/. An attacker can lure a user to a crafted link, causing JavaScript execution in the victim’s browser. The connected nuclei template confirms the impact; remediation is to upgrade t...

CVE-2021-43528

Thunderbird unexpectedly enabled JavaScript in the composition area. The JavaScript execution context was limited to this area and did not receive chrome-level privileges, but could be used as a stepping stone to further an attack with other vulnerabilities. This vulnerability affects Thunderbird...

Mozilla Firefox 跨站脚本漏洞

Mozilla Firefox is an open source Web browser from the Mozilla Foundation. Mozilla Firefox has a cross-site scripting vulnerability that stems from the fact that the product does not effectively filter the special characters in the Url in the QR code, which can be exploited by attackers to execut...

Mozilla Thunderbird < 91.4.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 91.4.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2021-54 advisory. - Mozilla developers and community members Julian Hector, Randell Jesup, Gabriele Svelto, Tyson Smith,...

CVE-2021-36760

In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code wi...

Security Vulnerabilities fixed in Thunderbird 91.4.0 — Mozilla

Under certain circumstances, asynchronous functions could have caused a navigation to fail but expose the target URL. An incorrect type conversion of sizes from 64bit to 32bit integers allowed an attacker to corrupt memory leading to a potentially exploitable crash. By misusing a race in our...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress Photo Gallery by 10Web plugin before 1.5.68 has a cross-site scripting vulnerability, which stems fro...

Design/Logic Flaw

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file...

Plupload 代码问题漏洞

Plupload is a cross-browser, multi-runtime file upload API. A security vulnerability exists in versions of plupload prior to 2.3.9 that allows an attacker to upload and run files containing JavaScript code...

WordPress 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress Awesome Support plugin in 6.0.6 and its...

EUVD-2021-2503

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to...

Cross-site Scripting (XSS)

wiki is vulnerable to cross-site scripting. The vulnerability exists because the library does not properly escape the HTML in the notification's title, allowing an attacker with access to the edit page to inject and execute malicious javascript via the title field...

PT-2021-22880 · Apache · Apache Jspwiki

Name of the Vulnerable Software and Affected Versions: Apache JSPWiki versions prior to 2.11.0 Description: A carefully crafted plugin link invocation could trigger an issue on Apache JSPWiki, related to the Denounce plugin, allowing the attacker to execute javascript in the victim's browser and...