2345 matches found
PT-2022-15844 · Open Xchange · Ox App Suite
Name of the Vulnerable Software and Affected Versions: OX App Suite versions 7.10.6 and earlier Description: The issue allows for cross-site scripting XSS attacks via the appHandler in a deep link within an e-mail message. This can potentially lead to malicious script execution on the client-side...
Remote Code Execution (RCE)
Redis is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the input allowing an attacker to inject maliciously crafted script into the system...
CVE-2022-33317
Inclusion of Functionality from Untrusted Control Sphere vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric...
Design/Logic Flaw
Inclusion of Functionality from Untrusted Control Sphere vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a...
CVE-2022-2039
The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupportisettings function found in the /livesupporti.php file. This makes it possible for unauthenticated attacke...
WordPress plugin Free Live Chat Support 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Free Live Chat Support...
Cross-site Scripting (XSS)
github.com/argoproj/argo-cd is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization allowing an attacker to inject maliciously crafted script via input in the /auth/callback page...
The vulnerability of the thread_call() function in the Squirrel programming language allows a hacker to trigger a service failure or execute arbitrary code.
The vulnerability of the threadcall function in the Squirrel programming language is related to the execution of operations outside of memory buffers. Exploiting this vulnerability can allow a remote attacker to cause service failures or execute arbitrary code using a specially created malware fi...
EyouCms Cross-Site Scripting Vulnerability (CNVD-2022-62185)
eyoucms is a content management system. A cross-site scripting vulnerability exists in the eyoucms login page, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to obtain sensitive information or hijack user sessions when malicious...
Remote Code Execution (RCE)
grub2 is vulnerable to remote code execution. The vulnerability exists due to an out-of-bounds write in the heap area allowing an attacker to inject maliciously crafted script into the system via a crafted 16-bit grayscale PNG image which allows an attacker to inject malicious codes...
Remote Code Execution (RCE)
grub2 is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the data pointer of the JPEG reader allowing an attacker to inject maliciously crafted script into the system via a crafted JPEG image...
Cross-site Scripting (XSS)
facturascripts/facturascripts is vulnerable to cross site scripting. The vulnerability exists due to a lack of sanitization of the username field allowing an attacker to input maliciously crafted script via the username field when showing 'login-user-not-found' message...
Cross-site Scripting (XSS)
francoisjacquet/rosariosis is vulnerable to cross-site scripting. The vulnerability exists because it does not escape HTML entities from URL in PreparePHPSELF.fnc.php, allowing an attacker to inject and execute malicious script...
stored xss
Description Stored XSS, also known as persistent XSS, is the more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Proof of Concept 1Go to this website: https://titra.io/ 2Click on add Track button 3In the Task field enter...
Remote Code Execution (RCE)
firefox is vulnerable to remote code execution. The vulnerability exists due to memory corruption allowing an attacker to inject maliciously crafted script into the system...
Magento stored cross-site scripting vulnerability
Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s brows...
Stored Cross Site Scripting on "Add user" field
Steps to reproduce: 1. Go to settings-- Access controls -- Add user 2. Payload = """ 3. Add XSS payload as username and create a new user 4. After creating the user, click on delete button and the XSS will be triggered POC Screenshot:...
Remote Code Execution (RCE)
tiddlywiki is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the upload function allowing an attacker to inject maliciously crafted script via a crafted SVG file...
Remote Code Execution (RCE)
firefox is vulnerable to remote code execution. The vulnerability exists due to a memory corruption allowing an attacker to inject maliciously crafted script into the system...