Cross site scripting

A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information to users. This vulnerability allowed a user with login access to the application to introduce XSS payload via browser details...

CVE-2023-6146 Stored XSS Vulnerability in QualysGuard VM/PC

A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information to users. This vulnerability allowed a user with login access to the application to introduce XSS payload via browser details...

CVE-2023-6146 Stored XSS Vulnerability in QualysGuard VM/PC

A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information to users. This vulnerability allowed a user with login access to the application to introduce XSS payload via browser details...

CVE-2023-6146

CVE-2023-6146 describes a stored cross-site scripting vulnerability in Qualys Web Application (QualysGuard VM/PC) where HTML encoding is omitted when displaying logging information. The root cause is the lack of HTML encoding in user-visible browser details, allowing a logged-in user to inject an...

Qualys Web Application Cross-Site Scripting Vulnerability

Qualys Web Application is a web application from Qualys, Inc. A cross-site scripting vulnerability exists in Qualys Web Application versions prior to 10.24.0.0, which arises from a lack of HTML coding when presenting logging information to a user, allowing a user with login access to the...

PT-2023-32544 · Qualys · Qualys Web Application

Name of the Vulnerable Software and Affected Versions: Qualys web application affected versions not specified Description: The issue is related to a stored XSS vulnerability in a Qualys web application. This vulnerability is caused by the absence of HTML encoding in the presentation of logging...

Unauthorized Access Vulnerability in Website Monitoring and Warning Platform of Yuanjiang Shengbang (Beijing) Network Security Technology Co.

Ltd. is an independent innovative enterprise dedicated to WEB application security solutions and application delivery. There is an unauthorized access vulnerability in the website monitoring and warning platform of Yuanjiang Shengbang Beijing Network Security Technology Co., Ltd. which can be...

CommentLuv <= 4 - Unauthenticated SSRF

Description The plugin is vulnerable to Server-Side Request Forgery via the doclick function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal service...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

By Owais Sultan Reflectiz, a cloud-based platform that helps organizations manage and mitigate web application security risks This is a post from HackRead.com Read the original post: Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

tomcat: Open Redirect vulnerability in FORM authentication

A flaw was found in Apache Tomcat if the default web application is configured with FormAuthenticator. This issue allows a specially crafted URL to trigger a redirect to an arbitrary URL...

WordPress Essential Addons for Elementor Pro Plugin < 5.4.9 CSRF Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpdeveloper:essentialaddonsforelementor"; if description...

PT-2023-32671 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue concerns a failure to validate route parameters in the Mattermost webapp, specifically in the //channels/ path, allowing an attacker to perform a client-side path traversal...

The vulnerability of the Mastodon web application for deploying distributed social networks, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the Mastodon web application for deploying distributed social networks is related to the lack of measures taken to protect the structure of the web page when processing oEmbed formatted data. Exploiting this vulnerability allows a remote attacker to perform cross-site scripti...

The vulnerability in the Mastodon web application for deploying distributed social networks, related to the use of domain names with incorrect links, allows a hacker to execute a cache poisoning attack.

The vulnerability of the Mastodon web application for deploying distributed social networks is related to the use of domain names with incorrect links. Exploiting this vulnerability could allow a malicious actor to carry out a DNS poisoning attack...

WordPress WooCommerce Plugin < 8.2.0 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:woocommerce:woocommerce"; ifdescription...

Imperva Named an Overall Leader in the KuppingerCole Leadership Compass: API Security and Management Report

Imperva named an Overall Leader Were thrilled to share that Imperva has achieved the prestigious status of Overall Leader in the KuppingerCole Leadership Compass: API Security and Management report. Our Leadership excels across the sub-categories of Product, Innovation, and Market Leadership and ...

Building an AppSec Program with Qualys WAS -Introduction and Configuring a Web Application or API: Default Scan Settings

Qualys WAS Web Application Scanning tools stand out as The Leading Dynamic Application Security Testing DAST solutions in the industry. Since it comes with default scan settings, understanding these settings in detail is critical to uncover vulnerabilities effectively. Scan performance and covera...

Bolstering API Security: Introducing Wallarm’s API Attack Surface Management (AASM)

In the fast-paced digital world, think of Application Programming Interfaces APIs as the threads that stitch together the fabric of our tech ecosystems. They're often overlooked, quietly ensuring that your apps communicate seamlessly and keep the digital world running smoothly. The majority of...

GHSA-8V6J-GC74-FMPP Ajax Pro Cross-site Scripting

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary JavaScript objects. Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise...