CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

Cross site scripting

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

CVE-2022-33974

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds Tweets Widget plugin = 1.8.4 versions...

CVE-2022-33974

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds Tweets Widget plugin = 1.8.4 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds Tweets Widget plugin = 1.8.4 versions...

CVE-2022-33974: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Smash Balloon Custom Twitter Feeds Tweets Widget plugin = 1.8.4 versions...

CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

PT-2023-19704 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions prior to 7.10.6-rev24 Description: The issue allows for XSS via data to the Tumblr portal widget, such as a post title. Recommendations: For versions prior to 7.10.6-rev24, update to version 7.10.6-rev24 or later to...

CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

CVE-2023-24602

Open-Xchange OX App Suite prior to frontend 7.10.6-rev24 is affected by CVE-2023-24602, a cross-site scripting (XSS) vulnerability in the Tumblr portal widget that could affect data such as a post title. The issue is documented across multiple sources, with remediation guidance indicating to upgr...

CVE-2023-24602: Improper Neutralization of Input During Web Page Generation

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

CVE-2023-24602

OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...

WordPress Plugin Custom Twitter Feeds 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33194 CraftCMS stored XSS in Quick Post widget error message

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

CVE-2023-33194 CraftCMS stored XSS in Quick Post widget error message

Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was patched in...

GHSA-QPGM-GJGF-8C2X Craft CMS XSS in RSS widget feed

Summary A malformed RSS feed can deliver an XSS payload PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f...

Craft CMS XSS in RSS widget feed

Summary A malformed RSS feed can deliver an XSS payload PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f...

CraftCMS stored XSS in Quick Post widget error message

Summary The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, cli...