Mautic Cross-Site Scripting Vulnerability (CNVD-2021-70087)

Mautic is an open source marketing automation software that monitors and manages websites, sends emails and manages customer resources. Mautic is vulnerable to a cross-site scripting vulnerability that stems from Mautic being vulnerable to an inline JS XSS attack when viewing Mautic assets by usi...

Mautic Code Injection Vulnerability

Mautic is an open source marketing automation software that monitors and manages websites, sends emails and manages customer resources. Mautic is vulnerable to a code injection vulnerability that stems from Mautic's vulnerability to JS XSS attacks. The attack is triggered when viewing a contact's...

CVE-2021-27911

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from...

CVE-2021-27912

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets...

CVE-2021-27912

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets...

Cross site scripting

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets...

CVE-2021-27912

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets...

CVE-2021-27912

The CVE-2021-27912 entry describes an inline JavaScript XSS vulnerability in Mautic assets that affects versions before 3.3.4/4.0.0. An authenticated user with permission to create or edit assets can leverage inline JS in asset titles and a broken image URL to perform the attack. The most consist...

CVE-2021-27912 XSS vulnerability on asset view

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets...

CVE-2021-27911

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from...

CVE-2021-27911 XSS vulnerability on contacts view

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from...

PT-2021-17665

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4/4.0.0 Description: The issue is related to an inline JS XSS attack that can be triggered through a contact's first or last name when viewing a contact's details page, clicking on the action drop down, and hoveri...

PT-2021-17666

Name of the Vulnerable Software and Affected Versions: Mautic versions prior to 3.3.4 Mautic versions prior to 4.0.0 Description: The issue allows for an inline JS XSS attack when viewing Mautic assets. This is achieved by utilizing inline JS in the title and adding a broken image URL as a remote...

ZEIT Next.js 跨站脚本漏洞

ZEIT Next.js is an open source web application framework from ZEIT based on Vue.js, Node.js, Webpack and Babel.js. Next.js versions 10.0.0 to 11.0.0 have a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary js commands...

CVE-2021-27912: Improper Neutralization of Input During Web Page Generation

Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets...

nodejs: Improper handling of untypical characters in domain names

A flaw was found in Node.js. These vulnerabilities include remote code execution, Cross-site scripting XSS, application crashes due to missing input validation of hostnames returned by Domain Name Servers in the Node.js DNS library, which can lead to the output of wrong hostnames leading to Domai...

nodejs: Incomplete validation of tls rejectUnauthorized parameter

A flaw was found in Node.js. If the Node.js HTTPS API is used incorrectly and "undefined" is passed for the "rejectUnauthorized" parameter, no error is returned, and the connections to servers with an expired certificate are accepted. The highest threat from this vulnerability is to integrity...

nodejs: Use-after-free on close http2 on stream canceling

A flaw was found in Node.js, where it is vulnerable to a use-after-free attack. This flaw allows an attacker to exploit the memory corruption, which causes a change in the process behavior. The highest threat from this vulnerability is to confidentiality and integrity...

@aeternity/aeproject (>=3.0.4, <=3.0.5), @berlinvege/fedockerjs (>=1.0.4, <=1.0.5) +93 more potentially affected by CVE-2021-23732 via docker-cli-js (>=1.0.9, <=2.10.0)

docker-cli-js NPM version =1.0.9, =3.0.4, =1.0.4, =0.0.10, =1.0.0, =0.0.1-dev.0, =0.0.1-dev.1, =1.0.710, =0.1.0, =3.0.28, =3.0.29, =0.0.1, =0.8.6, =1.0.0, =1.0.2 and more Source cves: CVE-2021-23732 Source advisory: SNYK:JS-DOCKERCLIJS-1568516...

U.S. Dept Of Defense: Open Akamai ARL XSS on http://master-config-████████

The Open Akamai ARL on http://master-config-████████ was found to be vulnerable to a Reflected Cross Site Scripting XSS vulnerability. The vulnerability was discovered in the "what" and "where" parameters of the search functionality. The vulnerability allowed the execution of arbitrary JavaScript...