Djblets Cross-site scripting Vulnerability

A cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

CVE-2022-1111: Undefined Security Weakness

A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the 'Access Granted' column in the project membership pages...

CVE-2021-37463

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...

CVE-2021-37463

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...

Cross site scripting

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...

CVE-2021-37463

CVE-2021-37463 affects NCH Quorum v2.03 and earlier, with a stored XSS in the User Display Name. The root cause is a script injection that is stored and rendered in the user display context. Impact stated in CNVD/CNNVD references describes attackers potentially stealing cookie‑based authenticatio...

CVE-2021-37463

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...

CVE-2021-37463: Improper Neutralization of Input During Web Page Generation

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...

PT-2021-21678

Name of the Vulnerable Software and Affected Versions NCH Quorum versions 2.03 and earlier Description A stored XSS issue exists via the User Display Name. Recommendations For versions 2.03 and earlier, update to a version later than 2.03 to resolve the issue...

Cross site scripting

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2021-21619: Improper Neutralization of Input During Web Page Generation

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2019-9758

An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/addUsers.view, or wiki/Administration/page.view in the admin panel, leading to privilege escalation...

CVE-2019-9758

An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/addUsers.view, or wiki/Administration/page.view in the admin panel, leading to privilege escalation...

Privilege escalation

An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view, security/addUsers.view, or wiki/Administration/page.view in the admin panel, leading to privilege escalation...

CVE-2019-9758

CVE-2019-9758 concerns LabKey Server 19.1.0 where the user display name is vulnerable to stored XSS that can execute in admin context. The issue affects administrators when viewing pages in the admin panel (security/permissions.view, security/addUsers.view, or wiki/Administration/page.view), pote...

MGASA-2014-0462 Updated python-djblets packages fix security vulnerabilities

Cross-site scripting XSS vulnerability in util/templatetags/djbletsjs.py in Djblets before 0.7.30 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name CVE-2014-3994...

Cross site scripting

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

PYSEC-2014-79

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...

PYSEC-2014-79

Cross-site scripting XSS vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name...