Cross-Site Scripting in i18next

Affected versions of i18next allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability. Proof of Concept js var init = i18n.initdebug: true, function var test = i18n.t'firstName lastName', escapeInterpolation: true, firstName:...

PT-2016-5017 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman versions prior to 1.10.3 Foreman version 1.11.0 before 1.11.0-RC2 Description: The issue allows remote authenticated users to read, modify, or delete private bookmarks by leveraging the edit bookmarks or destroy bookmarks permission...