PT-2022-11616

Name of the Vulnerable Software and Affected Versions CALDERA version 2.8.1 Description An issue was discovered in CALDERA that contains multiple reflected, stored, and self XSS vulnerabilities. These vulnerabilities may be exploited by both authenticated and unauthenticated attackers...

GHSA-X9R5-JXVQ-4387 jquery.terminal self XSS on user input

Impact This is low impact and limited XSS, because code for XSS payload is always visible, but attacker can use other techniques to hide the code the victim sees. Also if the application use execHash option and execute code from URL the attacker can use this URL to execute his code. The scope is...

CVE-2021-43862 Self XSS on user input

jQuery Terminal Emulator is a plugin for creating command line interpreters in your applications. Versions prior to 2.31.1 contain a low impact and limited cross-site scripting XSS vulnerability. The code for XSS payload is always visible, but an attacker can use other techniques to hide the code...

CVE-2021-44200

CVE-2021-44200 affects Acronis Cyber Protect 15 (Windows and Linux) prior to build 28035. The vulnerability is a self cross-site scripting (XSS) issue on the devices page. The provided documents do not disclose the exact underlying root cause or exploitation details beyond the XSS description. A ...

Self cross-site scripting (XSS) was possible on devices page

...

Judge.me : Self-XSS due to image URL can be eploited via XSSJacking techniques in review email

A self-XSS vulnerability was discovered in Judge.me due to the image URL of recommendations in the reviewer profile that could be exploited via XSSJacking techniques in the review email. An attacker could insert a payload in the image URL of recommendations and then use XSSJacking techniques to...

CVE-2021-41172

ASRedis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is...

Input validation

ASRedis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is...

CVE-2021-41172

ASRedis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is...

CVE-2021-41172

ASRedis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is...

CVE-2021-41172

CVE-2021-41172 concerns AS_Redis, an AntSword Redis plugin. The Redis Manage plugin before v0.5 is vulnerable to Self-XSS caused by insufficient input validation/sanitization in the Redis server configuration, enabling code execution through plugin configuration. Mitigation: upgrade to version 0....

CVE-2021-41172 Self-XSS in AS_Redis

ASRedis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is...

CVE-2021-41172: Improper Neutralization of Input During Web Page Generation

ASRedis is an AntSword plugin for Redis. The Redis Manage plugin for AntSword prior to version 0.5 is vulnerable to Self-XSS due to due to insufficient input validation and sanitization via redis server configuration. Self-XSS in the plugin configuration leads to code execution. This issue is...

CVE-2021-25938: Improper Neutralization of Input During Web Page Generation

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting XSS, since there is no validation of the .zip file name and filtering of potential abusive characters which zip files can be named to. There is no X-Frame-Options Header set, which makes it more susceptible for...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

Design/Logic Flaw

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

CVE-2021-31803: Improper Neutralization of Input During Web Page Generation

cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile SEC-581...

PT-2021-19517

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 94.0.3 Description The issue allows self-XSS via EasyApache 4 Save Profile. Recommendations For versions prior to 94.0.3, update to version 94.0.3 or later to resolve the issue...