12363 matches found
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper
Meta CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 4.1 Problem It has been discovered that the f:asset.css view helper is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Solution Update to TYPO3 version 10.4.32 or 11.5.16 that fix the probl...
TestLink 跨站脚本漏洞
TestLink is a set of open source software used by TestLink team to manage software testing process and provide statistical analysis. A security vulnerability exists in TestLink v1.9.20, which originates from a security issue in /lib/inventory/inventoryView.php...
PT-2022-22625 · Testlink · Testlink
Name of the Vulnerable Software and Affected Versions: TestLink version 1.9.20 Description: A stored cross-site scripting XSS issue was found in TestLink via the /lib/inventory/inventoryView.php API endpoint. Recommendations: For version 1.9.20, update to a newer version that contains a fix for...
Cross site scripting
PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting XSS during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the vi...
mariadb: server crashes in query_arena::set_query_arena upon SELECT from view
A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sqlclass.cc, impacting availability...
mariadb: Crash executing query with VIEW, aggregate and subquery
MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW...
TYPO3-CORE-SA-2022-010: Cross-Site Scripting in <f:asset.css> view helper
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-010...
TYPO3-CORE-SA-2022-010: Cross-Site Scripting in <f:asset.css> view helper
More info at https://typo3.org/security/advisory/typo3-core-sa-2022-010...
PT-2022-23198 · Typo3 · Typo3
Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 10.4.32 TYPO3 versions prior to 11.5.16 Description: The f:asset.css view helper in TYPO3 is vulnerable to cross-site scripting when user input is passed as variables to the CSS. Recommendations: Update to TYPO3 versio...
CVE-2022-38295
Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /tablemanager/view/cuusergroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function...
CVE-2022-38295
Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /tablemanager/view/cuusergroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function...
CVE-2022-36092
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes...
CVE-2022-36092 XWiki Platform Old Core vulnerable to Authentication Bypass Using the Login Action
XWiki Platform Old Core is a core package for XWiki Platform, a generic wiki platform. Prior to versions 14.2 and 13.10.4, all rights checks that would normally prevent a user from viewing a document on a wiki can be bypassed using the login action and directly specified templates. This exposes...
XWiki Platform 跨站脚本漏洞
XWiki Platform is a suite of Wiki platforms for creating web collaboration applications from the French company XWiki. A security vulnerability exists in the XWiki Platform Index UI prior to version 13.10.6 and prior to version 14.3, which stems from the ability to store JavaScript that can be...
mariadb: server crashes in query_arena::set_query_arena upon SELECT from view
A flaw was found in the MariaDB Server. It contains a segmentation fault via the component, sql/sqlclass.cc, impacting availability...
mariadb: Crash executing query with VIEW, aggregate and subquery
MariaDB before 10.7.2 allows an application crash because it does not recognize that SELECTLEX::nestlevel is local to each VIEW...
CVE-2022-36676
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /categories/viewcategory.php...
CVE-2022-36674
Simple Task Scheduling System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /schedules/viewschedule.php...