Design/Logic Flaw

An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of commedia leads to a XSS vulnerability...

CVE-2021-26039

CVE-2021-26039 affects Joomla! 3.0.0 through 3.9.27. The issue is an inadequate escaping in the imagelist view of the com_media component, causing a Cross-Site Scripting (XSS) vulnerability. This is consistently reported across NVD, OSV, and related feeds, with no exploit details provided in the ...

PT-2021-16932 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions 3.0.0 through 3.9.27 Description: An issue was discovered in the imagelist view of com media, where inadequate escaping leads to a XSS vulnerability. Recommendations: For versions 3.0.0 through 3.9.27, update to a version tha...

MISP 跨站脚本漏洞

MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics with features such as threat cybersecurity event analysis and malware analysis. A cross-site scripting vulnerability exists in app/View/SharingGroups/view.ctp in versions o...

CVE-2021-26039

An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of commedia leads to a XSS vulnerability...

Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue...

Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php, leading to a reflected Cross-Site Scripting issue. PoC https://www.example.com/?cpmvcid=1doaction=mvparse=editindex=0=1=0=F00=1=999=a%22%3E%3Csvg/%3E%3C%22...

Cisco Data Center Network Manager Authorization Bypass Vulnerabilities (cisco-sa-dcnm-authbypass-OHBPbxu)

The version of Cisco Data Center Network Manager installed on the remote host is prior to 11.51. It is, therefore, affected by multiple vulnerabilities in the web-based management interface. A remote, authenticated attacker can exploit these to view, modify, and delete data without proper...

CVE-2021-30648

The Symantec Advanced Secure Gateway ASG and ProxySG web management consoles are susceptible to an authentication bypass vulnerability. An unauthenticated attacker can execute arbitrary CLI commands, view/modify the appliance configuration and policy, and shutdown/restart the appliance...

CVE-2021-35959

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field...

PYSEC-2021-110

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field...

Symantec Advanced Secure Gateway 和 Symantec ProxySG 授权问题漏洞

Symantec Advanced Secure Gateway and Symantec ProxySG are both security gateway appliances from Symantec Corporation. An authorization issue vulnerability exists in Symantec Advanced Secure Gateway ASG and ProxySG web management consoles. An unauthenticated attacker could exploit this vulnerabili...

GHSA-W3JX-WV97-67PH Cross-site scripting in Dutchcoders transfer.sh

Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view...

Cross-site scripting in Dutchcoders transfer.sh

Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view...

The vulnerability of the shared/view_source.php component in the OpenClinic medical record management software allows a hacker to execute arbitrary code.

The vulnerability of the shared/viewsource.php component in the OpenClinic medical record management software is related to authentication errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Information Disclosure

flow-server is vulnerable to information disclosure. Lack of validation and sanitization of path in the default RouteNotFoundError view allows an attacker to enumerate available routes via malicious HTTP requests...

Seeddms 5.1.10 Remote Command Execution

Exploit Title: Seeddms 5.1.10 - Remote Command Execution RCE Authenticated Date: 25/06/2021 Exploit Author: Bryan Leong Vendor Homepage: https://www.seeddms.org/index.php?id=2 Software Link: https://sourceforge.net/projects/seeddms/files/seeddms-5.0.11/ Version: Seeddms 5.1.10 Tested on: Windows ...

CVE-2021-20579

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user who can create a view or inline SQL function to obtain sensitive information when AUTOREVAL is set to DEFFEREDFORCE. IBM X-Force ID: 199283...

CVE-2021-29944

Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affec...

CVE-2021-29944

Lack of escaping allowed HTML injection when a webpage was viewed in Reader View. While a Content Security Policy prevents direct code execution, HTML injection is still possible. Note: This issue only affected Firefox for Android. Other operating systems are unaffected.. This vulnerability affec...