CVE-2023-34221

In JetBrains TeamCity before 2023.05 stored XSS in the Show Connection page was possible...

PT-2023-24746 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.05 Description: The issue concerns a stored XSS vulnerability in the Show Connection page. This allows for potential malicious script execution. Recommendations: For versions prior to 2023.05, update ...

AZL-36943 CVE-2023-33187 affecting package highlight 4.18-1

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

CVE-2023-33187

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

Input validation

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

CVE-2023-33187 highlight vulnerable to cleartext transmission of sensitive information

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

CVE-2023-33187 highlight vulnerable to cleartext transmission of sensitive information

Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs...

GHSA-9QPJ-QQ2R-5MCC html inputs of type password recorded in plaintext when converted to text inputs

Impact Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates type="password" inputs. A customer may assume that switching to type="text"...

highlight.io 安全漏洞

highlight.io is open source full stack monitoring platform. Error monitoring, session replay, logging and more. A security vulnerability exists in highlight.io versions prior to 6.0.0 that stems from unintentionally logging password values when using the Show Password button...

PT-2023-24204 · Highlight · Highlight

Name of the Vulnerable Software and Affected Versions: Highlight versions prior to 6.0.0 Description: Highlight may record passwords on customer deployments when a password html input is switched to type="text" via a javascript "Show Password" button. This issue arises because the expected behavi...

PT-2023-6685 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: jeecg-boot versions 3.5.0 through 3.5.1 Description: The issue is related to a SQL injection vulnerability. It is associated with the lack of protection measures for the SQL query structure when processing the id parameter. This vulnerability...

warsawtoolsshow.com Cross Site Scripting vulnerability OBB-3341865

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-28318

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

PT-2023-21646 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat affected versions not specified Description: A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the Message KeepHistory or Message ShowDeletedStatus server configuration. This allows use...

Hiding in Plain Sight: Cross-Site Scripting Vulnerabilities Patched in Weaver Products

On March 14, 2023, the Wordfence Threat Intelligence team initiated the responsible disclosure process for 2 nearly identical Cross-Site Scripting vulnerabilities in the Weaver Xtreme theme and the Weaver Show Posts plugin, which each have over 10,000 installations. The plugin developer responded...

WordPress Weaver Xtreme 5.0.7 / Weaver Show Posts 1.6 Cross Site Scripting Vulnerability

WordPress Weaver Xtreme theme versions 5.0.7 and below and Weaver Show Posts plugin versions 1.6 and below suffer from a persistent cross site scripting vulnerability. On March 14, 2023, the Wordfence Threat Intelligence team initiated the responsible disclosure process for 2 nearly identical...

WordPress Weaver Xtreme 5.0.7 / Weaver Show Posts 1.6 Cross Site Scripting

On March 14, 2023, the Wordfence Threat Intelligence team initiated the responsible disclosure process for 2 nearly identical Cross-Site Scripting vulnerabilities in the Weaver Xtreme theme and the Weaver Show Posts plugin, which each have over 10,000 installations. The plugin developer responded...

Malicious code in com.example.show-toast (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da4961545d6c31acce87aae4be45c313c9bc7a0ce3e72eda23cced115c94c489 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Weaver Show Posts < 1.7 - Contributor+ Stored Cross-Site Scripting

The plugin does not properly escape the profile display name, leading to stored Cross-Site Scripting vulnerabilities...

SUSE CVE-2023-1625

An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' command to reveal parameters which are supposed to remain hidden. This has a low impact to the confidentiality, integrity, and availability of the system...