CVE-2021-38113: Improper Neutralization of Input During Web Page Generation

In addBouquet in js/bqe.js in OpenWebif aka e2openplugin-OpenWebif through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor i.e., bouqueteditor/api/addbouquet?name= leads to Stored XSS...

CVE-2021-33326

Cross-site scripting XSS vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window...

CVE-2019-14453

An issue was discovered in Comelit "App lejos de casa web" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges installer or administrator for the graphical interface via a...

Privilege escalation

An issue was discovered in Comelit "App lejos de casa web" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges installer or administrator for the graphical interface via a...

Cross-site Scripting (XSS) - Stored in kalcaddle/kodexplorer

✍️ Description XSS via SVG file Upload 🕵️‍♂️ Proof of Concept upload the svg file with xss payload and open it with browser alertdocument.domain; 💥 Impact Custom JS code execution embedded with in the svg file...

CVE-2021-32772

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allo...

CVE-2021-33326: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window...

PT-2021-8976

Name of the Vulnerable Software and Affected Versions Comelit "App lejos de casa web" version 2.8.0 Description The issue allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. An attacker can achieve high privileges, such as installer or...

PT-2021-20107

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.4 and earlier Liferay DXP 7.0 before fix pack 96 Liferay DXP 7.1 before fix pack 20 Liferay DXP 7.2 before fix pack 9 Description A cross-site scripting XSS issue in the Frontend JS module allows remote attackers to...

CVE-2019-14453: Improper Privilege Management

An issue was discovered in Comelit "App lejos de casa web" 2.8.0. It allows privilege escalation via modified domus and logged fields, related to js/bridge.min.js and login.json. For example, an attacker can achieve high privileges installer or administrator for the graphical interface via a...

CVE-2021-32772: Improper Neutralization of Special Elements used in an OS Command

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allo...

CVE-2021-29979

Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hosting domain.. This vulnerability affects Hubs Cloud mozillareality/reticulum/1.0.1/20210618012634...

Information disclosure

Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hosting domain.. This vulnerability affects Hubs Cloud mozillareality/reticulum/1.0.1/20210618012634...

CVE-2021-29979

Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hosting domain.. This vulnerability affects Hubs Cloud mozillareality/reticulum/1.0.1/20210618012634...

CVE-2021-29979: Improper Neutralization of Input During Web Page Generation

Hubs Cloud allows users to download shared content, specifically HTML and JS, which could allow javascript execution in the Hub Cloud instance’s primary hosting domain.. This vulnerability affects Hubs Cloud mozillareality/reticulum/1.0.1/20210618012634...

PT-2021-18559

Name of the Vulnerable Software and Affected Versions Hubs Cloud versions prior to 1.0.1/20210618012634 Description The issue allows users to download shared content, specifically HTML and JS, which could enable javascript execution in the Hub Cloud instance's primary hosting domain...

PT-2021-5821

Name of the Vulnerable Software and Affected Versions Node.js versions prior to 12.22.4 Node.js versions prior to 14.17.4 Node.js versions prior to 16.6.0 Description The issue is related to a use after free attack in Node.js, where an attacker might exploit memory corruption to change process...

OTRS Cross-Site Scripting Vulnerability (CNVD-2021-57225)

OTRS is an application of the German company OTRS. A cross-site scripting vulnerability exists in OTRS AG Time Accounting, which stems from the ability to inject malicious JS code into specific fields during the project creation screen. No details of the vulnerability are currently available...

CVE-2021-21442 XSS vulnerability in Time Accounting

In the project create screen it's possible to inject malicious JS code to the certain fields. The code might be executed in the Reporting screen. This issue affects: OTRS AG Time Accounting: 7.0.x versions prior to 7.0.19...

CVE-2021-21442

CVE-2021-21442 describes a cross-site scripting (XSS) vulnerability in OTRS Time Accounting. The issue allows injecting malicious JavaScript into fields on the project creation screen, with potential execution in the Reporting screen. Affected product: OTRS Time Accounting 7.0.x prior to 7.0.19. ...