2530 matches found
CVE-2022-44637
CVE-2022-44637 affects Redmine before 4.2.9 and 5.0.x before 5.0.4, where persistent XSS can be triggered via the Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on configuration, exploitation may require login as a registered user. Root cause: insu...
CVE-2022-44637
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
CVE-2022-44637
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
CVE-2022-44637: Improper Neutralization of Input During Web Page Generation
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user...
CVE-2022-44031: Improper Neutralization of Input During Web Page Generation
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields...
ThinkCMF Stored Cross-Site Scripting (XSS)
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting XSS. An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's...
CVE-2022-40849
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting XSS. An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's...
CVE-2022-40849
ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting XSS. An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's...
PT-2022-25579 · Thinkcmf · Thinkcmf
Name of the Vulnerable Software and Affected Versions: ThinkCMF version 6.0.7 Description: The issue allows an attacker to inject a Persistent XSS payload in the Slideshow Management section, executing arbitrary JavaScript code on the client side. This could be used to steal the administrator's P...
CVE-2022-45592
1 Server Side Request Forgery SSRF, 2 persistant Cross site scripting XSS, and 3 File upload vulnerability...
CVE-2022-43569: Improper Neutralization of Input During Web Page Generation
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-site scripting XSS in the object name of a Data Model...
CVE-2022-43561 Persistent Cross-Site Scripting in “Save Table” Dialog in Splunk Enterprise
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting XSS. The vulnerability affects instances with Splunk Web enabled...
XSS Stored inside Standard Interface Help Link href attribute
📜 Description Cross-site scripting XSS is a type of security vulnerability that can be found in some web applications. XSS attacks enable attackers to inject client-side scripts into web pages viewed by other users. The persistent or stored XSS vulnerability is a more devastating variant of a...
CVE-2022-43561: Improper Neutralization of Input During Web Page Generation
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting XSS. The vulnerability affects instances with Splunk Web enabled...
CVE-2022-42069: Improper Neutralization of Input During Web Page Generation
Online Birth Certificate Management System version 1.0 suffers from a persistent Cross Site Scripting XSS vulnerability...
CVE-2022-38073 WordPress Awesome Support plugin <= 6.0.7 - Multiple Authenticated Persistent XSS (Additional Interested Parties)
Multiple Authenticated custom specific plugin role Persistent Cross-Site Scripting XSS vulnerability in Awesome Support plugin = 6.0.7 at WordPress...
CVE-2022-38073
CVE-2022-38073 affects the WordPress Awesome Support plugin (versions ≤ 6.0.7). The root cause is insufficient sanitization of the ticket title, enabling a stored XSS by users with a custom plugin role (authenticated). The impact is persistent cross-site scripting within the plugin context. Advis...
CVE-2022-38073
Multiple Authenticated custom specific plugin role Persistent Cross-Site Scripting XSS vulnerability in Awesome Support plugin = 6.0.7 at WordPress...
CVE-2022-38073: Improper Neutralization of Input During Web Page Generation
Multiple Authenticated custom specific plugin role Persistent Cross-Site Scripting XSS vulnerability in Awesome Support plugin = 6.0.7 at WordPress...