4759 matches found
GHSA-8MQ9-FQV8-59WF Cross-Site Scripting in Page Preview
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC 5.0 Problem Failing to properly encode Page TSconfig settings, corresponding page preview module WebView is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability...
Cross-Site Scripting in Page Preview
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC 5.0 Problem Failing to properly encode Page TSconfig settings, corresponding page preview module WebView is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability...
CVE-2021-32667
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When Page TSconfig settings are not properly encoded, corresponding page preview module WebView is vulnerabl...
CVE-2021-32667 Cross-Site Scripting in Page Preview
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When Page TSconfig settings are not properly encoded, corresponding page preview module WebView is vulnerabl...
TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-009...
TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-009...
Cross-Site Scripting in Page Preview
Failing to properly encode Page TSconfig settings, the corresponding page preview module WebView is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability...
PT-2021-3864 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions 9.0.0 through 9.5.28 TYPO3 versions 10.0.0 through 10.4.17 TYPO3 versions 11.0.0 through 11.3.0 Description: The issue is related to the implementation of the Page TSconfig configuration in the TYPO3 content management system,...
Cross-site Scripting (XSS)
mongo-express is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script via a string property of documents when only preview is loaded...
The vulnerability of the ksys2.dll library in the KOMPAS-3D 3D modeling system, which is related to the execution of operations outside the buffer in memory, allows a hacker to cause a service failure.
The vulnerability of the ksys2.dll library in the KOMPAS-3D three-dimensional modeling system relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to cause a service failure using the preview function for a specially crafted T3D...
CVE-2021-32924
Invision Community aka IPS Community Suite before 4.6.0 allows eval-based PHP code injection by a moderator because the IPS\cms\modules\front\pages\builder::previewBlock method interacts unsafely with the IPS\Theme::runProcessFunction method...
CVE-2021-33558
Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files are not par...
May 20, 2021—KB5003212 (OS Build 18363.1593) Preview
None None...
File upload local preview can run embedded scripts after user interaction
Impact When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely ...
GHSA-8796-GC9J-63RV File upload local preview can run embedded scripts after user interaction
Impact When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely ...
CVE-2021-32622 File upload local preview can run embedded scripts after user interaction
Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the previ...
vmd 跨站脚本漏洞
vmd is a software application. Preview markdown files in a separate window A cross-site scripting vulnerability exists in vmd version 1.34.0 and earlier versions, which leaks div class="markdown-body"...
JetBrains YouTrack Information Disclosure Vulnerability (CNVD-2021-34743)
YouTrack is a keyboard-based issue and project tracking tool from the Czech company JetBrains, primarily used for tracking tasks and defect correction arrangements during development. An information disclosure vulnerability exists in the "Issue Preview" of JetBrains YouTrack versions prior to...
