WebSoft HCM 跨站脚本漏洞

WebSoft HCM is a talent management and HR services platform from WebSoft Ukraine. A security vulnerability exists in WebSoft HCM version 2021.2.3.327, which stems from insufficient handling of user input and allows an authenticated attacker to inject arbitrary HTML markup into pages processed by...

CVE-2022-46148

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the stable branch and versions 2.9.0.beta11 and prior on the beta and tests-passed branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS o...

Design/Logic Flaw

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the stable branch and versions 2.9.0.beta11 and prior on the beta and tests-passed branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS o...

CVE-2022-46148

Discourse self-XSS vulnerability (CVE-2022-46148) affects the Discourse open‑source platform. In versions 2.8.10 and earlier on stable, and 2.9.0.beta11 and earlier on beta/tests-passed branches, a user able to craft malicious messages and navigate to the drafts page could trigger self‑XSS, poten...

CVE-2022-46148 Discourse allows self-XSS through malicious composer message

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the stable branch and versions 2.9.0.beta11 and prior on the beta and tests-passed branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS o...

CVE-2022-46148: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the stable branch and versions 2.9.0.beta11 and prior on the beta and tests-passed branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS o...

CVE-2022-46148 Discourse allows self-XSS through malicious composer message

Discourse is an open-source messaging platform. In versions 2.8.10 and prior on the stable branch and versions 2.9.0.beta11 and prior on the beta and tests-passed branches, users composing malicious messages and navigating to drafts page could self-XSS. This vulnerability can lead to a full XSS o...

CVE-2022-26330

Potential vulnerabilities have been identified in Micro Focus ArcSight Logger. The vulnerabilities could be remotely exploited resulting in Information Disclosure, or Self Cross-Site Scripting XSS. This issue affects: Micro Focus ArcSight Logger versions prior to v7.2.2 version and prior versions...

CVE-2022-26330

CVE-2022-26330 affects Micro Focus ArcSight Logger prior to version 7.2.2. The documented impact is information disclosure and self XSS, with remote exploitation described in multiple sources. The root cause details are not fully enumerated in the provided documents, but the vulnerability targets...

Shopify: Self XSS in https://linkpop.com/dashboard/admin

Summary: Hello Shopify team, Found a self XSS https://linkpop.com/dashboard/admin, the steps to reproduce are below Steps To Reproduce: 1- Visit https://linkpop.com/dashboard/admin 2- Click on links = add links 3- add in the url input javascript:alertdocument.cookie F1757141 4- Click on the link...

Croogo vulnerable to Cross-site Scripting in title field

A stored self-XSS exists in Croogo before v3.0.7, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4...

GHSA-Q5FG-V5P7-R424 Croogo vulnerable to Cross-site Scripting in title field

A stored self-XSS exists in Croogo before v3.0.7, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4...

Croogo vulnerable to XSS in Blog field

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog...

CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat...

CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...

CVE-2022-21830

CVE-2022-21830 concerns a blind self-XSS in Rocket.Chat LiveChat. The vulnerability affects LiveChat versions prior to 1.9, where an attacker could coerce a user into pasting malicious code within the chat, enabling script execution in the victim’s browser. Reported by multiple sources (GHSA, Red...

PT-2022-15163

Name of the Vulnerable Software and Affected Versions RocketChat LiveChat versions prior to 1.9 Description A blind self XSS issue exists that could allow an attacker to trick a victim into pasting malicious code in their chat instance. This could potentially lead to the execution of unauthorized...

CVE-2022-21830: Improper Neutralization of Input During Web Page Generation

A blind self XSS vulnerability exists in RocketChat LiveChat...

CVE-2021-42558

An issue was discovered in CALDERA 2.8.1. It contains multiple reflected, stored, and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers...

CVE-2021-42558: Improper Neutralization of Input During Web Page Generation

An issue was discovered in CALDERA 2.8.1. It contains multiple reflected, stored, and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers...