CVE-2021-31905

In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible...

CVE-2021-31905

CVE-2021-31905 affects JetBrains YouTrack prior to 2020.6.8801, where the vulnerability enables information disclosure through the Issue Preview component. The issue is documented across multiple sources (NVD entry, Red Hat advisory, CNVD/CVE listings, and JetBrains security bulletin). Root cause...

CVE-2021-31905

In JetBrains YouTrack before 2020.6.8801, information disclosure in an issue preview was possible...

JetBrains YouTrack 信息泄露漏洞

YouTrack is a keyboard-based issue and project tracking tool from the Czech company JetBrains, primarily used for tracking tasks and defect correction arrangements during development. An information disclosure vulnerability exists in the "Issue Preview" of JetBrains YouTrack versions prior to...

CVE-2021-30172

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

Cross site scripting

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

CVE-2021-30172 Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

CVE-2021-30172

CVE-2021-30172 affects the Jun-He/Quan-Fang-Wei-Tong-Xun system: special characters on the image preview page input are not filtered, enabling a remote authenticated attacker to inject JavaScript via reflected XSS and access/manipulate customer information. Connected sources confirm the XSS vecto...

CVE-2021-30172

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

竣禾科技全方位通讯系统跨站脚本漏洞

Junghee Technology Omni-Communication System is an application software of China Junghee Technology Co. It is used for communication gateway system. A cross-site scripting vulnerability exists in the Junghua Technology Omni-Communication System, which originates from the special characters on the...

Tagstoo 2.0.1 Cross Site Scripting / Code Execution

Exploit Title: Tagstoo v2.0.1 - Stored XSS to RCE Exploit Author: TaurusOmar Twitter:@TaurusOmar HomePage:taurusomar.com Date: May 4th, 2021 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Risk: High 8.8 Vendor Homepage: https://tagstoo.sourceforge.io/ Version: v2.0.1 Tested on: Windows, Linux, MacO...

Tagstoo 2.0.1 - Stored XSS to Remote Command Execution Vulnerability

Exploit Title: Tagstoo 2.0.1 - Stored XSS to RCE Exploit Author: TaurusOmar CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Risk: High 8.8 Vendor Homepage: https://tagstoo.sourceforge.io/ Version: v2.0.1 Tested on: Windows, Linux, MacOs Software Description: Software to tag folders and files, with...

CVE-2021-29484

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

CVE-2021-29484 DOM XSS in Theme Preview

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

PT-2021-18246 · Ghost · Ghost

Name of the Vulnerable Software and Affected Versions: Ghost versions 4.0.0 through 4.3.2 Description: An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click...

April 28, 2021—KB5001391 (OS Builds 19041.964 and 19042.964) Preview

None None...

File Upload Vulnerability in OfficeWeb365 of Xi'an Daxi Information Technology Co.

OfficeWeb365 focuses on Office document online preview and PDF document online preview cloud services, including Microsoft Word document online preview, Excel table online preview, Powerpoint presentation document online preview, WPS word processing, WPS forms, WPS presentations and Adobe PDF...

GHSA-GCM9-CC3R-C6VJ Cross-site Scripting (XSS) in Eclipse Theia

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview @theia/preview, can be exploited to execute arbitrary code...

Cross-site Scripting (XSS) in Eclipse Theia

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview @theia/preview, can be exploited to execute arbitrary code...

Cross-site Scripting (XSS)

Overview ngx-markdown-editor is an Angular markdown editor based on ace editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS. The vulnerability can be exploited when previewing the Markdown content. Details Cross-site scripting or XSS is a code vulnerability that...