140 matches found
CVE-2021-41465
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41464
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41464: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
Portlandlabs Concrete5 跨站脚本漏洞
Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "rel" parameter to inject arbitrary web scri...
CVE-2021-41465: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
PortlandLabs Concrete Cms 跨站脚本漏洞
Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "rel" parameter to inject arbitrary web scri...
CVE-2021-35240
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'...
CVE-2021-35240
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'...
Cross site scripting
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'...
CVE-2021-35240: Improper Neutralization of Input During Web Page Generation
A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'...
Solarwinds Orion Platform 跨站脚本漏洞
Solarwinds Orion Platform is a network fault and network performance management platform from Solarwinds, Inc. The platform provides real-time monitoring and analysis of network devices, and supports custom web interfaces, multiple user opinions, and map-based browsing of the entire network, etc....
Command injection
An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary system commands...
CVE-2021-28857
CVE-2021-28857 affects TP-Link TL-WPA4220 devices running 4.0.2 Build 20180308 Rel.37064, where credentials (username and password) are transmitted via cookies. The information disclosure stems from cookies leaking credentials, enabling a potential attacker to obtain login data without exploitati...
CVE-2021-29053
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1 CommerceChannelRelFinder.countByCC, or 2 CommerceChannelRelFinder.findByCC...
The vulnerability of the wp_targeted_link_rel() function in the WordPress content management system, related to the lack of protective measures for website structures, allows attackers to compromise data integrity.
The vulnerability of the wptargetedlinkrel function in the WordPress content management system is related to a storage-related error in the script. Exploiting this vulnerability could allow an attacker to compromise the integrity of the data...
CVE-2020-9375
TP-Link Archer C50 V3 devices before Build 200318 Rel. 62209 allows remote attackers to cause a denial of service via a crafted HTTP Header containing an unexpected Referer field...
CVE-2019-13653: Improper Neutralization of Special Elements used in an OS Command
TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection issue 5 of 5...
GHSA-9MRQ-CJGH-32G2 smartbanner.js rel noopener vulnerability
rel noopener vulnerability Impact Clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile 3rd parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. Patches rel="noopener" is automatical...
smartbanner.js rel noopener vulnerability
rel noopener vulnerability Impact Clicking on smartbanner View link and navigating to 3rd party page leaves window.opener exposed. It may allow hostile 3rd parties to abuse window.opener, e.g. by redirection or injection on the original page with smartbanner. Patches rel="noopener" is automatical...