Hitachi Vantara Hitachi Content Platform 安全漏洞

Hitachi Vantara Hitachi Content Platform is an object storage system from Hitachi Vantara, Inc. that provides massively scalable, reliable, efficient and easy-to-use storage for automated management and preservation of content. An access control error vulnerability exists in Hitachi Vantara Hitac...

Rocket.Chat 安全漏洞

Rocket.Chat is an open source team chat software. Chat suffers from an elevation of privilege vulnerability that stems from improper privilege management in the application, which can be exploited by any authenticated attacker to gain elevated privileges to view direct messages without proper...

CVE-2022-39975: Missing Authorization

The Layout module in Liferay Portal v7.3.3 through v7.4.3.34, and Liferay DXP 7.3 before update 10, and 7.4 before update 35 does not check user permission before showing the preview of a "Content Page" type page, allowing attackers to view unpublished "Content Page" pages via URL manipulation...

CVE-2022-3255

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

CVE-2022-35196

TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery CSRF via /lib/plan/planView.php...

CVE-2022-37700: Improper Limitation of a Pathname to a Restricted Directory

Zentao Demo15 is vulnerable to Directory Traversal. The impact is: obtain sensitive information remote. The component is: URL : view-source:https://demo15.zentao.pm/user-login.html/zentao/index.php?mode=getconfig...

prairieviewrent.com Cross Site Scripting vulnerability OBB-2934021

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-35194

TestLink v1.9.20 was discovered to contain a stored cross-site scripting XSS vulnerability via /lib/inventory/inventoryView.php...

TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper

Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 4.1 Problem It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Solution Update to TYPO3 version 10.4.32 or 11.5.16 that fix the probl...

TestLink 跨站脚本漏洞

TestLink is a set of open source software used by TestLink team to manage software testing process and provide statistical analysis. A security vulnerability exists in TestLink v1.9.20, which originates from a security issue in /lib/inventory/inventoryView.php...

PT-2022-22625 · Testlink · Testlink

Name of the Vulnerable Software and Affected Versions: TestLink version 1.9.20 Description: A stored cross-site scripting XSS issue was found in TestLink via the /lib/inventory/inventoryView.php API endpoint. Recommendations: For version 1.9.20, update to a newer version that contains a fix for...

Cross site scripting

PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting XSS during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the vi...

CVE-2022-37137: Improper Neutralization of Input During Web Page Generation

PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting XSS during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the vi...

mariadb: server crashes in query_arena::set_query_arena upon SELECT from view

A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sqlclass.cc, impacting availability...

mariadb: Crash executing query with VIEW, aggregate and subquery

MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW...

TYPO3-CORE-SA-2022-010: Cross-Site Scripting in <f:asset.css> view helper

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-010...

TYPO3-CORE-SA-2022-010: Cross-Site Scripting in <f:asset.css> view helper

More info at https://typo3.org/security/advisory/typo3-core-sa-2022-010...

PT-2022-23198 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 10.4.32 TYPO3 versions prior to 11.5.16 Description: The f:asset.css view helper in TYPO3 is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Recommendations: Update to TYPO3 versio...

CVE-2022-38295

Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /tablemanager/view/cuusergroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function...

CVE-2022-38295

Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /tablemanager/view/cuusergroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function...