147 matches found
CVE-2023-44813: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function...
Dooblou WiFi File Explorer 跨站脚本漏洞
Dooblou WiFi File Explorer is a free WiFi file explorer from Dooblou. A cross-site scripting vulnerability exists in Dooblou WiFi File Explorer version 1.13.3, which stems from the parameter search/order/download/mode that causes cross-site scripting...
CVE-2023-3034
Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions =2.0.44...
CVE-2023-3034: Improper Input Validation
Reflected XSS affects the ‘mode’ parameter in the /admin functionality of the web application in versions =2.0.44...
PT-2023-22643 · Softwarex · Softwarex
Name of the Vulnerable Software and Affected Versions: SoftwareX versions =2.0.44 Description: Reflected XSS affects the mode parameter in the "/admin" functionality of the web application. Recommendations: For versions =2.0.44, update to a version greater than 2.0.44 to resolve the issue. As a...
PT-2023-17137 · Otcms · Otcms
Name of the Vulnerable Software and Affected Versions: OTCMS version 6.72 Description: A vulnerability was found in the function AutoRun of the file apiRun.php. The manipulation of the argument mode leads to cross-site scripting. The attack can be launched remotely. Recommendations: For OTCMS...
NYUCCL psiTurk 代码注入漏洞
NYUCCL psiTurk is a scientific open platform on Amazon Mechanical Turk. A security vulnerability exists in NYUCCL psiTurk version 3.2.0 and prior versions, which stems from an incorrect manipulation of the parameter mode that can lead to invalidation of special elements used in the template engin...
GHSA-CQ7Q-5C67-W39W matrix-appservice-irc vulnerable to IRC mode parameter confusion
Impact IRC allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such modes incorrectly, potentially resulting in the wrong user being given permissions. Mode command...
CVE-2022-39202 IRC mode parameter confusion in matrix-appservice-irc
matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. The Internet Relay Chat IRC protocol allows you to specify multiple modes in a single mode command. Due to a bug in the underlying matrix-org/node-irc library, affected versions of matrix-appservice-irc perform parsing of such...
GHSA-6C8C-F2W2-JVJR Alkacon OpenCMS XSS via homelink, workplaceresource, mode and query parameters
Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms 9.5.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 homelink parameter to system/modules/org.opencms.workplace.help/jsptemplates/helphead.jsp, 2 workplaceresource parameter to...
UBUNTU-CVE-2022-21704
log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable in unix. This could cause problems if log files contain sensitive information. This would affect any users that have not...
PT-2022-1771 · Unknown · Log4Js-Node
Name of the Vulnerable Software and Affected Versions: log4js-node versions prior to 6.4.0 Description: The issue is related to the default file permissions for log files created by the file, fileSync, and dateFile appenders in log4js-node, which are world-readable in Unix. This could cause...
CVE-2021-41461
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter...
CVE-2021-41461
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter...
Portlandlabs Concrete5 跨站脚本漏洞
Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "mode" parameter to inject arbitrary web...
CVE-2021-41461: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter...
The vulnerability of the eDocLib platform for storing and processing corporate data arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out cross-site scripting attacks.
The vulnerability of the eDocLib platform for storing and processing corporate data exists due to the lack of measures taken to protect the structure of its web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in a speciall...