Stored XSS vulnerability when importing RSS Feeds from external source

Description YetiForceCRM allows user create RSS Feeds without purifying the link field of the input data properly from external source. An attacker can take advantage of this vulnerability to perform an XML Injection attack that leads to stored cross-site scripting XSS on the target server. Proof...

Automattic: Stored XSS in intensedebate.com via the Comments RSS

Stored XSS in intensedebate.com via the Comments RSS In our "comments.rss" file, the blog post's title reflects to the XML RSS file without any encoding. So I installed the IntenseDebate on my website https://wp.s2.cm, and created a blog post with alertdocument.domain payload on the title. Then, ...

Blind SSRF on the RSS Feed

A normal user can add an RSS Feed with an internal URL which could lead to a blind SSRF issue by using local URLs...

rss.holdthefrontpage.co.uk Cross Site Scripting vulnerability OBB-2754472

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

rssfeedgroup.co.uk Cross Site Scripting vulnerability OBB-2722945

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in hub-rss-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3158b4ecaff25a1c2e806a027dc70cd4f3c129c035ab63635299227ef24766b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3713 Malicious code in hub-rss-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3158b4ecaff25a1c2e806a027dc70cd4f3c129c035ab63635299227ef24766b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hub-rss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2c3f2d68e315b2b7c48efbdcacbf670e5763f027831953c2d37200b8f2d9a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3712 Malicious code in hub-rss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2c3f2d68e315b2b7c48efbdcacbf670e5763f027831953c2d37200b8f2d9a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-C33V-23RX-7QQC Magento 2 Community Edition IDOR Vulnerability

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

Magento 2 Community Edition IDOR Vulnerability

An insecure direct object reference IDOR vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details...

Fedora: Security Advisory for php-openpsa-universalfeedcreator (FEDORA-2022-a66124e04f)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for php-openpsa-universalfeedcreator (FEDORA-2022-59f0ad964c)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: php-openpsa-universalfeedcreator-1.8.4.1-1.fc35

RSS and Atom feed generator. Supported formats: RSS0.91, RSS1.0, RSS2.0, PIE0.1 deprecated, MBOX, OPML, ATOM, ATOM0.3, HTML, JS, PHP. Autoloader: /usr/share/php/openpsa-universalfeedcreator/autoload.php...

[SECURITY] Fedora 36 Update: php-openpsa-universalfeedcreator-1.8.4.1-1.fc36

RSS and Atom feed generator. Supported formats: RSS0.91, RSS1.0, RSS2.0, PIE0.1 deprecated, MBOX, OPML, ATOM, ATOM0.3, HTML, JS, PHP. Autoloader: /usr/share/php/openpsa-universalfeedcreator/autoload.php...

[SECURITY] Fedora 34 Update: php-openpsa-universalfeedcreator-1.8.4.1-1.fc34

RSS and Atom feed generator. Supported formats: RSS0.91, RSS1.0, RSS2.0, PIE0.1 deprecated, MBOX, OPML, ATOM, ATOM0.3, HTML, JS, PHP. Autoloader: /usr/share/php/openpsa-universalfeedcreator/autoload.php...

MoinMoin Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the rsslink function in theme/init.py in MoinMoin before 1.9.6 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link...

GHSA-79HJ-474H-V4XV Plone denial of service via RSS Feed Request

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...

Plone denial of service via RSS Feed Request

pythonscripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service infinite loop via an RSS feed request for a folder the user does not have permission to access...

au.com.permeance:liferay-clojure-integration (=0.1), com.liferay.maven.plugins:liferay-maven-plugin (>=6.0.2 <=6.0.6) +6 more potentially affected by CVE-2010-5327 via com.liferay.portal:portal-impl (>=5.2.3 <=6.2.1)

com.liferay.portal:portal-impl MAVEN version =5.2.3, =6.0.2, =6.1.2, =5.2.3, =2.4, =1.0, =2.0, =2.5 Source cves: CVE-2010-5327 Source advisory: OSV:GHSA-97GM-MCV6-CPHM...