13092 matches found
TYPO3 powermail extension allows remote attackers to bypass CAPTCHA protection mechanism
The powermail extension 2.x before 2.0.11 for TYPO3 allows remote attackers to bypass the CAPTCHA protection mechanism via unspecified vectors...
TYPO3 Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field...
Jenkins Vulnerable to Clickjacking
Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to conduct clickjacking attacks via unspecified vectors...
GHSA-H52H-972R-68MH Jenkins Build Failure Analyzer Plugin allows Cross-Site Scripting (XSS)
Cross-site scripting XSS vulnerability in the Build Failure Analyzer plugin before 1.5.1 for Jenkins allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...
GHSA-6W8C-6JRG-QWJ2 Radicale regex metacharacters injection in the user name
Radicale before 1.1 allows remote authenticated users to bypass ownerwrite and owneronly limitations via regex metacharacters in the user name, as demonstrated by...
phpMyAdmin allows remote attackers to spoof content via the url parameter
The redirection feature in url.php in phpMyAdmin 4.4.x before 4.4.15.1 and 4.5.x before 4.5.1 allows remote attackers to spoof content via the url parameter...
GHSA-4WCC-JV3P-PRQW Cherry Music Cross-site Scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist...
GHSA-J76Q-99X2-V7VQ Apache Ambari Improper Access Control
Custom commands may be executed on Ambari Agent 2.4.x, before 2.4.2 hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agen...
GHSA-R64J-5W3W-FP49 TeamPass vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...
MODX Revolution cross-site scripting vulnerability
In MODX Revolution before 2.5.7, a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php...
GHSA-V7QF-22RW-CHPH MantisBT XSS via adm_config_report.php's action parameter
A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...
GHSA-XVX2-WQF5-JJGV typo3/cms-felogin Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in the frontend plugin for the felogin system extension in TYPO3 4.2.0, 4.2.1 and 4.2.2 allows remote attackers to inject arbitrary web script or HTML via unknown vectors...
Liferay Portal XSS Vulnerability
Cross-site scripting XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address...
GHSA-8GQF-26XW-X3GX Liferay Portal XSS Vulnerability
Cross-site scripting XSS exists in Liferay Portal before 7.0 CE GA4 via a login name, password, or e-mail address...
GHSA-RMQC-WFJM-3F66 TYPO3 Directory Traversal vulnerability
Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."...
GHSA-2H23-C973-X63Q phpMyAdmin Cross-site Scripting vulnerability
Cross-site scripting XSS vulnerability in libraries/config/ConfigFile.class.php in the setup interface in phpMyAdmin 3.4.x before 3.4.9 allows remote attackers to inject arbitrary web script or HTML via the host parameter...
Static Methods since 2007 (div2007) extension for TYPO3 vulnerable to Cross-site Scripting
Cross-site scripting XSS vulnerability in the Static Methods since 2007 div2007 extension before 0.10.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the t3libdiv::quoteJSvalue function...
GHSA-Q326-JHW3-699G Improper Neutralization of Input During Web Page Generation in IPython
Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...
Apache Wicket allows attackers to check for third-party libraries
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use...