Design/Logic Flaw

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file...

IBM Jazz Team Server cross-site scripting vulnerability

IBM Jazz Team Server is an application server from IBM Corporation in the United States. provides base services that enable a group of tools to work together as a single logical server and includes any number of Jazz Team Server Extensions that provide tool-specific functionality. IBM Jazz Team...

CVE-2022-2102: Improper Enforcement of Behavioral Workflow

Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file...

CVE-2022-33113

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module...

CVE-2022-33113

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module...

CVE-2022-33113

CVE-2022-33113 affects Jfinal CMS v5.1.0. A cross-site scripting vulnerability allows an attacker to inject and trigger arbitrary JavaScript via a crafted payload in the keyword field of the Publish Blog module. The issue is documented across multiple feeds (including Red Hat, Veracode, CNVD and ...

CVE-2022-33113

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module...

PT-2022-21102

Name of the Vulnerable Software and Affected Versions 74cmsSE version 3.5.1 Description A reflective cross-site scripting XSS issue was found in the component /index/jobfairol/show/. This issue allows for the execution of malicious scripts on the client-side, potentially leading to unauthorized...

CVE-2022-31734

Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior to 12.250SY...

Trendnet IP-110wn Cross-Site Scripting Vulnerability

Trendnet IP-110wn is a wireless network camera from Trendnet. A cross-site scripting vulnerability exists in the Trendnet IP-110wn fwtv-ip110wnv2 1.2.2.68 version, which stems from a lack of checksum filtering of user-supplied and output data in the proname parameter in /admin/scheprofile.cgi. An...

Haraj cross-site scripting vulnerability

A security vulnerability exists in Haraj v3.7, a buying and selling platform from Haraj Saudi Arabia, due to a cross-site scripting issue in the comments section of advertisements. An attacker could exploit the vulnerability to execute arbitrary Web script or HTML via a crafted POST request...

PT-2022-20369

Name of the Vulnerable Software and Affected Versions Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" Description The issue is related to Cross-Site Scripting XSS and can be exploited via the admin-MaintenanceDevice Management section. Thi...

PT-2022-19900

Name of the Vulnerable Software and Affected Versions Strapi versions 3.x.x and earlier Description The issue is related to a stored cross-site scripting vulnerability in the file upload function. This vulnerability allows an arbitrary script to be executed on the web browser of the user who is...

CVE-2022-30738

Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script...

CVE-2022-30738

Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script...

PT-2022-20276

Name of the Vulnerable Software and Affected Versions Samsung Internet versions prior to 17.0.1.69 Description The issue is related to an improper check in the Loader component of Samsung Internet, which allows attackers to spoof the address bar by executing a script. This can potentially lead to...

CVE-2022-30738: Improper Check or Handling of Exceptional Conditions

Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script...

CVE-2022-29296

A reflected cross-site scripting XSS vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

h2: Loading of custom classes from remote servers through JNDI

A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...

PT-2022-19524

Name of the Vulnerable Software and Affected Versions Avantune Genialcloud ProJ - 10 Description A reflected cross-site scripting XSS vulnerability in the login portal allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations For Avantune Genialcloud ProJ -...