CVE-2022-27213: Improper Neutralization of Input During Web Page Generation

Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with View/Configure permission...

CVE-2022-27197: Improper Neutralization of Input During Web Page Generation

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views...

Stored XSS vulnerability in dashboard-view

dashboard-view 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure views. dashboard-view 2.18.1 performs URL validation for the Iframe Portlet's Ifra...

Jenkins List Git Branches Parameter 插件跨站脚本漏洞

Jenkins and Jenkins Plugin are both products of Jenkins, which is an application. Jenkins Plugin is an application that provides hundreds of plugins to support building and deploying projects, and the Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier is vulnerable to a cross-site...

PT-2022-18301 · Jenkins · Jenkins Environment Dashboard Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Environment Dashboard Plugin versions 1.1.10 and earlier Description: The issue is related to a stored cross-site scripting XSS vulnerability. It occurs because the Environment order and the Component order configuration values in the...

Apple iOS和Apple iPadOS 访问控制错误漏洞

Apple iOS and Apple iPadOS are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple iPadOS is an operating system for iPad tablets.Apple iOS 15.4 and iPadOS 15.4 prior to CoreMedia have an access control error vulnerability. An Access Control Error vulnerabili...

CVE-2021-44585

A Cross Site Scripting XSS vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event...

CVE-2021-32005

Cross-site Scripting XSS vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution. This issue affects: Secomea SiteManager Version 9.6.621421014 and all prior versions...

CVE-2021-32005

Cross-site Scripting XSS vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution. This issue affects: Secomea SiteManager Version 9.6.621421014 and all prior versions...

CVE-2021-44585: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerabilitiy exits in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event...

Jeecg-Boot 跨站脚本漏洞

Jeecg-Boot is a low-code platform based on the code generator from the JeecgBoot community. Jeecg-Boot 3.0 has a security vulnerability that stems from a cross-site script in /jeecg-boot/jmreport/view that causes a mouse hover event. No details of the vulnerability are currently available...

CVE-2022-0434

The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the postids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks...

CVE-2022-0434

The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the postids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks...

Sql injection

The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the postids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks...

CVE-2021-32005: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS vulnerability in log view of Secomea SiteManager allows a logged in user to store javascript for later execution. This issue affects: Secomea SiteManager Version 9.6.621421014 and all prior versions...

CVE-2022-0434: Improper Neutralization of Special Elements used in an SQL Command

The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the postids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks...

WordPress plugin Page View Count SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in the WordPress plugin...

WordPress的Hotscot Contact Form插件 SQL注入漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.A SQL injection vulnerability exists in WordPress Hotscot Contact Form, which stems from a view submission featu...

IPCOMM ipDIO Cross-Site Scripting Vulnerability (CNVD-2022-20535)

IPCOMM ipDIO is a remote control communication device from IPCOMM Germany. It is used to record digital and analog inputs and control digital outputs. A cross-site scripting vulnerability exists in IPCOMM ipDIO that allows an unauthenticated, remote attacker to exploit the vulnerability to...

Cross-site Scripting (XSS)

viewcomponent is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization in the translate method in the translatable.rb file...