PT-2022-23189 · Xwiki · Xwiki Platform Wiki Ui Main Wiki

Name of the Vulnerable Software and Affected Versions: XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 13.10.5 XWiki Platform Wiki UI Main Wiki versions 5.3-milestone-2 through 14.3 Description: It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity...

PT-2022-23596 · Jitsi · Jitsi

Name of the Vulnerable Software and Affected Versions: Jitsi version 2.10.5550 Description: The issue allows attackers to perform a clickjacking attack via a crafted HTTP request in the web UI. It is noted that this is disputed by the vendor. Recommendations: For Jitsi version 2.10.5550, as a...

多款 XWiki Platform 产品代码注入漏洞

XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from XWiki France. A security vulnerability exists in the XWiki Platform Tag UI versions prior to 13.10.6 and 14.4, which stems from the fact that the tag document "Main.Tags" is not properly cleaned up from...

The vulnerability of the User Interface sub-component of the Oracle WebCenter Sites Support Tools software platform allows a malicious individual to gain unauthorized access to read, modify, or add data, or to cause service interruptions.

The vulnerability of the User Interface sub-component of the Oracle WebCenter Sites Support Tools software platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to read, modify, or add...

The vulnerability of the Google Chrome browser’s WebUI user interface allows a hacker to execute arbitrary code.

The vulnerability of the Google Chrome browser’s WebUI interface is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Weave GitOps 跨站脚本漏洞

Weave GitOps is a simple open source developer platform open sourced by Weaveworks. A security vulnerability exists in Weave GitOps Enterprise prior to version 0.9.0-rc.5, which stems from having cross-site scripting XSS that allows a malicious user to inject a javascript link into the UI, which...

Google Chrome 缓冲区错误漏洞

Google Chrome is a web browser from Google, an American company. A buffer overflow vulnerability exists in versions of Google Chrome prior to 105.0.5195.52, which originates from a boundary error when handling untrusted input in the WebUI. An attacker can exploit the vulnerability to trick a user...

CVE-2021-38934

IBM Engineering Test Management 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

IBM Engineering Test Management 跨站脚本漏洞

IBM Engineering Test Management is a collaborative quality management software from IBM USA that provides end-to-end test planning and test asset management to improve team efficiency. A security vulnerability exists in IBM Engineering Test Management version 7.0, 7.0.1, and 7.0.2, which stems fr...

PT-2022-10809 · Ibm · Ibm Engineering Test Management

Name of the Vulnerable Software and Affected Versions: IBM Engineering Test Management versions 7.0 through 7.0.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

CVE-2022-35714

IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116...

PT-2022-22945 · Ibm · Ibm Maximo Asset Management

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management version 7.6.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2022-35714

IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116...

KLA15728 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface, cause denial of service. Below is a complete list of vulnerabilities: 1. Memor...

KLA15726 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Memory safety vulnerability can be...

KLA15730 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information, spoof user interface, cause denial of service. Below is a complete list of vulnerabilities: 1. Memor...

Error: User not authorized to execute this command when executing commands via CLI or GUI

Local User Receives:ERROR: Not authorized to execute this commandon CLI and in GUI. CLI GUI...

KLA15727 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. Security UI vulnerability in...

CVE-2021-39035

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.5, 6.1.0.0 through 6.1.0.4, and 6.1.1.0 through 6.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2022-36311

Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models...