7039 matches found
XSS vulnerability in translations
Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack...
GHSA-RRGW-3HG3-9X8C XSS vulnerability in translations
Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack...
PT-2022-28278
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned, so the information cannot be provided. Description The issue allows an attacker with admin privileges and access to Translations management functionality to add a JS payload to translation values...
PT-2022-8881
Name of the Vulnerable Software and Affected Versions cscms version 4.1 Description The issue allows for SQL injection via the js del function. This enables potential attackers to inject malicious SQL code, which could lead to unauthorized access or manipulation of database content. Recommendatio...
js-data-dao (1.0.0) potentially affected by CVE-2021-23574 via js-data (3.0.0-rc.5)
js-data NPM version 3.0.0-rc.5 is affected by a known vulnerability. The following packages have a transitive dependency on js-data and may be impacted: - js-data-dao 1.0.0 Source cves: CVE-2021-23574 Source advisory: OSV:GHSA-C6H4-GC3F-HGJQ...
GHSA-C6H4-GC3F-HGJQ Prototype Pollution in js-data
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442...
CVE-2021-43852 JavaScript Prototype Pollution in oro/platform
OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...
CVE-2021-43852
CVE-2021-43852 (OroPlatform) : A prototype pollution flaw allows an attacker to inject properties into JavaScript prototypes (e.g., Object prototypes) via specially crafted requests, potentially enabling JS code execution by vulnerable libraries. The issue is mitigated by patching to version 4.2....
CVE-2021-43852
OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...
CVE-2021-43852: Improper Neutralization of Special Elements in Output Used by a Downstream Component
OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are...
serenity:FuzzJs: Bad-cast to AK::Array<AK::TypeErasedParameter, 0>JS::exp in JS::BinaryExpression::execute
Project: https://github.com/SerenityOS/serenity.git Detailed Report: https://oss-fuzz.com/testcase?key=4719830054338560 Project: serenity Fuzzing Engine: libFuzzer Fuzz Target: FuzzJs Job Type: libfuzzerubsanserenity Platform Id: linux Crash Type: Bad-cast Crash Address: 0x7ffdaa1a4e28 Crash Stat...
CVE-2021-43856
Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser e.g...
Prototype Pollution
js-data is vulnerable to pollution prototype. The vulnerability exists due to an incomplete fix of CVE-2020-28442. A remote attacker is able to inject arbitrary properties into existing construct prototypes and modify attributes via the deepFillIn and the set functions resulting in prototype...
PT-2021-23982
Name of the Vulnerable Software and Affected Versions: Wiki.js versions 2.5.263 and earlier Description: The issue concerns stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute...
CVE-2021-43856: Improper Neutralization of Input During Web Page Generation
Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser e.g...
Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot
Title Stored XSS in customattributes Description Relying on frontend URI check without verifying it on the backend allows to inject arbitrary JS code. Steps to reproduce 1. 1. Create a custom attribute, set its type to Link 2. 2. Navigate to any conversation, click on the right sidebar. 3. 3...
CVE-2021-23574
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442...
CVE-2021-23574
All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of CVE-2020-28442...
