CVE-2023-25836

CVE-2023-25836 describes a cross-site scripting vulnerability in Esri Portal for ArcGIS Sites (versions 10.9 and below). A remote, authenticated attacker can craft a link that, when clicked, executes arbitrary JavaScript in the victim’s browser. Privileges required are low, and user interaction i...

CVE-2023-25835

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configuration. When accessed by a victim, the...

PT-2023-20343

Name of the Vulnerable Software and Affected Versions Esri ArcGIS Enterprise Sites versions 10.8.1 through 10.9 Description The issue is a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link which, when clicked by a victim, could potentially...

Oracle WebCenter Sites (Jul 2023 CPU)

The 12.2.1.4.0 version of WebCenter Sites installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory. - Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites XStream. The supported version...

PT-2023-20342 · Esri · Esri Portal Sites

Name of the Vulnerable Software and Affected Versions: Esri Portal Sites versions 10.8.1 through 10.9 Description: The issue is a Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a crafted link which, when clicked, could potentially execute arbitrary...

CVE-2023-25835

Summary (CVE-2023-25835) : A stored Cross-Site Scripting (XSS) vulnerability affects Esri Portal for ArcGIS Enterprise Sites versions 10.8.1–11.1, where a remote, authenticated attacker with high privileges can craft a link stored in the site configuration that, when clicked by a victim, executes...

CVE-2023-25835 BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability

There is a stored Cross‑Site Scripting XSS vulnerability in Esri Portal for ArcGIS Sites versions 11.1 and below that may allow a remote, authenticated attacker with high‑privileged access to create a crafted link that is persisted within the site configuration. When accessed by a victim, the...

CVE-2023-33866

A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. By prematurely deleting objects associated with pages, a specially crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution...

CVE-2023-30433 IBM Security Verify Access HTTP open redirect

IBM Security Verify Access 10.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious W...

WordPress WordPress Everse Starter Sites – Elementor Templates Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Everse Starter Sites – Elementor Templates Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8f53de574344 Credi...

WordPress Spice Starter Sites Plugin < 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Spice Starter Sites Type Plugin Vulnerable versions 1.1 Fixed in 1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9401fa99b65e Credits Rafie Muhammad Patchstack Required...

WordPress BotMate - Automate or Sync Your Sites With No Code Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software BotMate - Automate or Sync Your Sites With No Code Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8348fa6fe814 Credits...

WordPress GloriousThemes Starter Sites Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software GloriousThemes Starter Sites Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fbb0bb613259 Credits Rafie Muhammad...

Fedora 38 : yt-dlp (2023-9f3938e10d)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-9f3938e10d advisory. Update to 2023.07.06. Mitigates CVE-2023-35934 / GHSA-v8mc-9377-rwjj Tenable has extracted the preceding description block directly from the Fedora security...

USN-6201-1 firefox vulnerabilities

Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information across domains, or execute arbitrary code. CVE-2023-37201, CVE-2023-37202,...

Jenkins: XSS vulnerability in plugin manager

A flaw was found in Jenkins. Affected versions of Jenkins do not escape the Jenkins version that a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins in the plugin manager. This issue results in a stored Cross-site scripting XSS...

The vulnerability of the Mozilla Firefox browser, related to the redirection of URLs to unreliable websites, allows attackers to bypass security restrictions and redirect users to arbitrary URL addresses.

The vulnerability of the Mozilla Firefox browser is related to the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and redirect users to arbitrary URL addresses...

CVE-2023-29307

Adobe Experience Manager versions 6.5.16.0 and earlier is affected by a URL Redirection to Untrusted Site 'Open Redirect' vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user...

Warning: GravityRAT Android Trojan Steals WhatsApp Backups and Deletes Files

An updated version of an Android remote access trojan dubbed GravityRAT has been found masquerading as messaging apps BingeChat and Chatico as part of a narrowly targeted campaign since June 2022. "Notable in the newly discovered campaign, GravityRAT can exfiltrate WhatsApp backups and receive...

Adobe Experience Manager 输入验证错误漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...