4813 matches found
Incorrect version tags linked to external repository
Impact A security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse...
PT-2026-52608
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.0 Description A supply chain incident occurred where incorrect version tags were pushed to the official repository. These tags pointed to an unreviewed personal fork of a contributor who had write access...
The vulnerability of the Admin Console console for Oracle WebLogic Server applications allows attackers to execute cross-site scripting attacks.
The vulnerability of the Admin Console console of Oracle WebLogic Server applications relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
PT-2026-52607
Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.0 Description A supply chain issue exists where incorrect version tags were pushed to the repository, linking to unreviewed code from a personal fork. This allows attackers to execute unreviewed and...
Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
✍️ Description There is svg tag filtration problem in "book page" egit leading to stored XSS. SVG images can be used on book pages, but there is not server side attribute filtration implemented for it. 🕵️♂️ Proof of Concept There is filter for href attribute, but inside SVG xlink:href used. That...
CVE-2020-18467
Cross Site Scripting XSS vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create...
CVE-2020-18467
Cross Site Scripting XSS vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create...
Cross site scripting
Cross Site Scripting XSS vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create...
CVE-2020-18467
Cross Site Scripting XSS vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create...
GHSA-XR7R-88QV-Q7HM Out of bounds write in serde_cbor
Affected versions of this crate did not properly check if semantic tags were nested excessively during deserialization. This allows an attacker to craft small 1 kB CBOR documents that cause a stack overflow. The flaw was corrected by limiting the allowed number of nested tags...
travelmanagers.com.au Cross Site Scripting vulnerability OBB-2125991
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
GHSA-R6MV-PPJC-4HGR PHP file inclusion via insert tags
Impact It is possible for untrusted users to load arbitrary PHP files via insert tags. Installations are only affected if there are untrusted back end users. Patches Update to Contao 4.4.56, 4.9.18 or 4.11.7. Workarounds Disable the login for untrusted back end users. References...
CVE-2021-34665
The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saqtxtthefilter parameter in the /wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7...
CVE-2021-34665
The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saqtxtthefilter parameter in the /wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7...
CVE-2021-34665 WP SEO Tags <= 2.2.7 Reflected Cross-Site Scripting
The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saqtxtthefilter parameter in the /wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7...
CVE-2021-34665 WP SEO Tags <= 2.2.7 Reflected Cross-Site Scripting
The WP SEO Tags WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the saqtxtthefilter parameter in the /wp-seo-tags.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.2.7...
CVE-2021-34665
CVE-2021-34665 : The WordPress plugin WP SEO Tags has a Reflected Cross-Site Scripting vulnerability via the saq_txt_the_filter parameter in the ~/wp-seo-tags.php file, affecting versions up to and including 2.2.7. The issue allows injection of arbitrary web scripts and is triggered by user input...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. WordPress WP SEO Tags plugin has a security...
WordPress WP SEO Tags plugin <= 2.2.7 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress WP SEO Tags plugin versions = 2.2.7. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...