Reflected Cross-site Scripting

Overview opencart/opencart is a shopping cart system Affected versions of this package are vulnerable to Reflected Cross-site Scripting. A reflected XSS issue was identified in the filename parameter of the admin tool/log route. An attacker could obtain a user's token by tricking the user to clic...

CVE-2024-3110

A stored Cross-Site Scripting XSS vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them...

CVE-2024-3110

Concretely, CVE-2024-3110 affects mintplex-labs/anything-llm before version 1.0.0. The root cause is improper sanitization/validation of user-supplied URLs when embedding them as external links with icons, allowing a stored XSS via javascript: payloads. Exploitation requires user interaction (e.g...

CVE-2024-3110 Stored XSS leading to admin account takeover in mintplex-labs/anything-llm

A stored Cross-Site Scripting XSS vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them...

PT-2024-23768 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 1.0.0 Description: A stored Cross-Site Scripting XSS vulnerability exists in the mintplex-labs/anything-llm application. The vulnerability arises from the application's failure to properly sanitize...

CVE-2024-3110: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them...

CVE-2024-5478: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability exists in the SAML metadata endpoint /auth/saml/$org?.id/metadata of lunary-ai/lunary version 1.2.7. The vulnerability arises due to the application's failure to escape or validate the orgId parameter supplied by the user before incorporating it into the...

PT-2024-21251 · Interaction Design Team At The University Of Applied Sciences Arts In Hildesheim/Germany +1 · Hawki

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The application does not change the session token when using the login or logout functionality. An attacker can set a session token in the victim's browser, for example via XSS, and...

CVE-2024-5042

CVE-2024-5042 concerns the Submariner project where the Submariner-operator exposes unnecessary RBAC permissions. The underlying issue allows a privileged attacker to run a malicious container on a node, potentially stealing service account tokens and compromising other nodes or the entire Kubern...

CVE-2024-5042

A flaw was found in the Submariner project. Due to unnecessary role-based access control permissions, a privileged attacker can run a malicious container on a node that may allow them to steal service account tokens and further compromise other nodes and potentially the entire cluster...

Submariner Operator 安全漏洞

Submariner Operator is a Submariner open source for installing Submariner components on Kubernetes clusters. A security vulnerability exists in Submariner Operator, which stems from unnecessary role-based access control privileges that allow a privileged attacker to steal service account tokens a...

PHOENIX CONTACT CHARX SEC-3000 安全漏洞

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in the PHOENIX CONTACT CHARX SEC-3000 version 1.5.1 and earlier, which originates from an unauthenticated, remote attacker who can extract session tokens via a MitM attack...

CVE-2024-28866: Improper Neutralization of Input During Web Page Generation

GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 inclusive are potentially vulnerable to a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a redirectto query parameter with inadequate validation. Attackers...

CVE-2024-2419 Keycloak: path traversal in the redirect validation

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...

CVE-2024-2419

CVE-2024-2419 concerns Keycloak’s redirect_uri validation, enabling an open-redirect that could facilitate phishing and token theft by a remote attacker. The issue allows bypassing otherwise allowed hosts and could enable impersonation of other users via stolen access tokens. CVSS v3.1 base score...

CVE-2024-2419 Keycloak: path traversal in the redirect validation

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...

CVE-2024-2419

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...

CVE-2024-2419 Keycloak: path traversal in the redirect validation

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...

CVE-2024-2419

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...

CVE-2024-2419: URL Redirection to Untrusted Site

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...