Aternity SteelCentral AppInternals跨站脚本漏洞

Aternity SteelCentral AppInternals is a monitoring modern automation solution from Aternity, Inc. A cross-site scripting vulnerability exists in Aternity SteelCentral AppInternals, which can be exploited by remote attackers to inject malicious script or HTML code...

Cross-site Scripting (XSS)

primefaces is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of the input values in AvatarRenderer.java allowing an attacker to inject maliciously crafted script via writeText function...

Cross-site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting. An attacker is able to inject a malicious script to "/gxadmin/index.php?page=themes=options" via the introtitle and introimage parameters, causing an execution of malicious script upon user's visit...

Cross-site Scripting (XSS)

weblate is vulnerable to cross-site scripting. An attacker is able to inject malicious script via user name and language parameters because user inputs were not escaped...

CVE-2020-14502

The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote, unauthenticated attacker could store a malicious script within the web interface that, when executed, could modify some string values on the homepage of the web interface...

Cross-site Scripting (XSS)

openmct is vulnerable to cross-site scripting. The library does not properly escape the URL field in the Web Page element, allowing an attacker to inject and execute malicious script...

Cross-site Scripting (XSS)

kibana is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of the index pattern allowing an attacker to inject maliciously crafted script via the index pattern...

Remote Code Execution (RCE)

IBM MQ is vulnerable to remote code execution. The vulnerability exists due to an insecure deserialization of trusted data allowing an attacker to execute maliciously crafted script on the system...

Cross-site Scripting (XSS)

drupal is vulnerable to cross-site scripting. An attacker is able to inject malicious script via \Drupal\Core\Form\FormBuilder's renderPlaceholderFormAction and/or buildFormAction methods...

Remote Code Execution

mockserver-core is vulnerable to remote code execution. The use of dynamic creation of expectations using Javascript or Velocity templates and default CORS configuration in MockServer allow an attacker to inject malicious script while running MockServer locally...

Remote Code Execution (RCE)

zsh is vulnerable to remote code execution. The vulnerability exists due to the ability to inject maliciously crafted script to control a command output inside the prompt...

CVE-2022-23707

An XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permissions to create index patterns can inject malicious javascript into the index pattern which could execute against other users...

CVE-2021-42940

A Cross Site Scripting XSS vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code...

Remote Code Execution (RCE)

Chrome is vulnerable to remote code execution. The vulnerability exists due to a lack a sanitization that allows an attacker to inject maliciously crafted script...

CVE-2022-23707

A Cross-Site Scripting XSS vulnerability was found in Kibana index patterns. Using this vulnerability, an authenticated user with permission to create index patterns can inject malicious javascript into the index pattern, which could execute against other users...

Remote Code Execution (RCE)

webkit2gtk is vulnerable to remote code execution. The vulnerability exists due to a type confusionallowing an attacker to inject maliciously crafted script via web content...

Remote Code Execution (RCE)

webkit2gtk is vulnerable to remote code execution. The vulnerability exists due to an out-of-bounds read allowing an attacker to inject maliciously crafted script via web content...

CVE-2022-23127

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the...

CVE-2022-23127

Cross-site Scripting vulnerability in Mitsubishi Electric MC Works64 versions 4.04E 10.95.210.01 and prior and ICONICS MobileHMI versions 10.96.2 and prior allows a remote unauthenticated attacker to gain authentication information of an MC Works64 or MobileHMI and perform any operation using the...

Cross-site Scripting (XSS) - Stored in erudika/scoold

Description The Schold is a Q&A/knowledge base platform written in Java. When writing a Q&A, you can use the markdown editor. So I tried to exploit the syntax to try an XSS attack. It seemed to validate javascript: on the backend. So I couldn't use it. However, according to RFC3986, the scheme ca...