12423 matches found
Sophos UTM 跨站脚本漏洞
Sophos UTM is a next-generation firewall. A security vulnerability exists in Sophos UTM versions prior to 9.706. The vulnerability stems from stored XSS that can be executed as an administrator in the quarantine email details view...
Command Execution Vulnerability in I Doc View Online Document Preview System
I Doc View Online Document Preview is an online document preview system. A command execution vulnerability exists in I Doc View Online Document Preview that can be exploited by an attacker to execute arbitrary commands...
_doSherX optimistically assumes premiums will be paid
Handle cmichel Vulnerability details The doSherX function does not attempt to pay off the accrued premiums "pay off debt" for most tokens, only for the ones that would otherwise revert the tx: // Expensive operation, only execute to prevent tx reverts if amountsi ps.sherXUnderlying...
jenkins: view name validation bypass
A flaw was found in Jenkins. Due to lack of validation of the newly created view name, an attackers with View/Create permission are allowed to create views with invalid or already-used names...
jenkins-2-plugins/credentials: Reflected XSS vulnerability in Credentials Plugin
The reflected cross-site scripting XSS vulnerability was found in jenkins credentials plugin. On a view it there is no escape from provided by user information user-controlled...
CVE-2021-35479
CVE-2021-35479 affects Nagios Log Server prior to version 2.1.9, where a Stored XSS vulnerability exists in the custom column view of the alert history and audit log via the affected pp parameter. Exploitation is described as requiring a crafted link or a third‑party webpage to trigger the vulner...
CVE-2021-35479
Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page...
CVE-2021-21443
Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG OTRS Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27...
CVE-2021-25205
SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via the update parameter to empViewUpdate.php...
GHSA-6MH3-J5R5-2379 Cross-Site Scripting in Query Generator & Query View
Meta CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C 4.5 Problem Failing to properly encode error messages, the components QueryGenerator and QueryView are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileg...
CVE-2021-26223
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to viewpay.php...
[SECURITY] Fedora 33 Update: kernelshark-1.2-5.fc33
KernelShark is a front end reader of trace-cmd output. "trace-cmd record" and "trace-cmd extract" create a trace.dat trace-cmd.dat file. kernelshark can read this file and produce a graph and list view of its data...
Charitable - Donation Plugin < 1.6.51 - Unauthenticated Stored Cross-Site Scripting
While fixing an Authenticated Stored Cross-Site Scripting issue https://wpscan.com/vulnerability/a5837621-ee6e-4876-9f65-82658fc0341f, the vendor identified another Cross-Site Scripting issue, which could be exploited by unauthenticated users and would be triggered in the context of a logged in...
Code injection
IBM Cloud Pak System 2.3 could allow a local user in some situations to view the artifacts of another user in self service console. IBM X-Force ID: 197497...
CVE-2021-32669
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...
Cross site scripting
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...
CVE-2021-32669 Cross-Site Scripting in Backend Grid View
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...
TYPO3-CORE-SA-2021-011: Cross-Site Scripting in Backend Grid View
More info at https://typo3.org/security/advisory/typo3-core-sa-2021-011...