CVE-2019-11718: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper...

CVE-2019-11718

Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper...

UBUNTU-CVE-2019-11718

Activity Stream can display content from sent from the Snippet Service website. This content is written to innerHTML on the Activity Stream page without sanitization, allowing for a potential access to other information available to the Activity Stream, such as browsing history, if the Snipper...

PT-2019-4556

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 68 Description The issue is related to the implementation of the Activity Stream page in Firefox, where content is written without proper sanitization, potentially allowing a remote attacker to access confidential dat...

FreeBSD : Gitlab -- Multiple Vulnerabilities (4ea507d1-9da8-11e9-a759-001b217b3468)

Gitlab reports : Ability to Write a Note to a Private Snippet Recent Pipeline Information Disclosed to Unauthorised Users Resource Exhaustion Attack Error Caused by Encoded Characters in Comments Authorization Issues in GraphQL Number of Merge Requests was Accessible Enabling One of the Service...

Sodin ransomware exploits Windows vulnerability and processor architecture

When Sodin also known as Sodinokibi and REvil appeared in the first half of 2019, it immediately caught our attention for distributing itself through an Oracle Weblogic vulnerability and carrying out attacks on MSP providers. In a detailed analysis, we discovered that it also exploits the...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Ability to Write a Note to a Private Snippet Recent Pipeline Information Disclosed to Unauthorised Users Resource Exhaustion Attack Error Caused by Encoded Characters in Comments Authorization Issues in GraphQL Number of Merge Requests was Accessible Enabling One of the Service...

Wolf CMS Cross-Site Scripting Vulnerability (CNVD-2019-14101)

Wolf CMS is a PHP-based open source content management system CMS from the Wolf CMS team. The system provides a user interface , templates , user management and rights management and other functions . Add Snippet module is one of the modules used to add code snippets . A cross-site scripting...

Cross site scripting

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...

CVE-2019-10646

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...

CVE-2019-10646

CVE-2019-10646 affects Wolf CMS v0.8.3.1 with a reflected/stored XSS in the Add Snippet module (/?/admin/snippet/add). An attacker can inject arbitrary JavaScript as user input, which executes when the affected snippet loads. This vulnerability is confirmed by multiple sources in the connected do...

CVE-2019-10646: Improper Neutralization of Input During Web Page Generation

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...

PT-2019-11961

Name of the Vulnerable Software and Affected Versions Wolf CMS version 0.8.3.1 Description The issue allows an attacker to insert arbitrary JavaScript as user input in the "Add Snippet" module, which is accessible through the "/admin/snippet/add" API endpoint. This input will be executed whenever...

CVE-2018-20777

Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field...

CVE-2018-20777

Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field...

CVE-2018-20777

CVE-2018-20777 affects Frog CMS 0.9.5 with Cross-Site Scripting in the admin/?/snippet/edit/1 Body field. The NVD entry lists a CVSSv3.0 base score of 5.4 (MEDIUM) with NETWORK attack vector, LOW privileges required, user interaction REQUIRED, and a CHANGED scope; CVSSv2 base score is 3.5 (LOW). ...

PT-2019-10220

Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue is related to a XSS flaw. It can be exploited via the Body field in the admin/?/snippet/edit/1 endpoint. Recommendations: For Frog CMS version 0.9.5, update to a version that includes a fix for th...

CVE-2018-20777: Improper Neutralization of Input During Web Page Generation

Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit/1 Body field...

The vulnerability of the Xapian::MSet::snippet() function in the Xapian search library (xapian-core) allows a hacker to execute cross-site scripts.

The vulnerability of the Xapian::MSet::snippet function “queryparser/termgeneratorinternal.cc” from the Xapian full-text search library xapian-core is related to insufficient protection of the web page structure. Exploiting this vulnerability could allow a malicious actor to execute cross-site...

FROG CMS Cross-Site Scripting Vulnerability (CNVD-2019-00385)

Frog CMS is a content management system CMS developed by software developer Philippe Archambault. The system provides tools for page templates, user rights management, and document management. A cross-site scripting vulnerability exists in FROG CMS version 0.9.5, which can be exploited by a remot...