Cross site scripting

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

UBUNTU-CVE-2023-5546

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

UBUNTU-CVE-2023-5544

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

CVE-2023-5546 Moodle: stored xss in quiz grading report via user id number

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

CVE-2023-5546

CVE-2023-5546 concerns Moodle: stored cross-site scripting via quiz grading report, triggered by displaying user-id numbers without adequate sanitization. The connected sources consistently describe this as a Moodle-related vulnerability where the risk is a stored XSS, arising from insufficient i...

CVE-2023-5546 Moodle: stored xss in quiz grading report via user id number

ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...

CVE-2023-5544

CVE-2023-5544 relates to a stored XSS and potential IDOR risk in Moodle Wiki comments due to insufficient sanitization and access restrictions. Connected sources (OSV/GHSA advisories and Nessus notes) corroborate a Wiki comments stored XSS/IDOR issue, with no explicit affected versions or patch d...

Cross site scripting

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...

CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...

CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...

CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby

BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...

PT-2023-29868 · Unknown · Rs-Stellar-Strkey

Name of the Vulnerable Software and Affected Versions: rs-stellar-strkey versions prior to 0.0.8 Description: A panic vulnerability occurs when a specially crafted payload is used, due to an issue with the inner payload len variable. This variable should not be above 64. The vulnerability is caus...

Deserialization Of Untrusted Data

org.apache.inlong: manager-pojo is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to filterSensitive function in MySQLSinkDTO.java not properly sanitizing whitespace characters, especially the horizontal tab \t, in URL parameters, which allows these characters to bypass...

CVE-2023-41629

A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal...

Path traversal

A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal...

CVE-2023-41629

A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal...

CVE-2023-41629

CVE-2023-41629 concerns a path traversal vulnerability in the file download feature of eSST Monitoring v2.147.1, caused by a lack of input sanitizing. The issue is documented across multiple sources in the connected set, which consistently describe a path traversal risk that could be exploited vi...

CVE-2023-41629

A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal...

Cross Site Scripting (XSS)

cecilapp/cecil is vulnerable to Reflected Cross-site Scripting XSS. The vulnerability is caused by not sanitizing and escaping special characters in the request URI path for the Cecil site generated by cecil serve when 404.html is not configured. This can lead to unauthenticated remote attackers...

CVE-2023-30534

Cacti is an open source operational monitoring and fault management framework. There are two instances of insecure deserialization in Cacti version 1.2.24. While a viable gadget chain exists in Cacti’s vendor directory phpseclib, the necessary gadgets are not included, making them inaccessible an...