Fedora 30 : ckeditor (2020-261449d821)

CKEditor 4.14 Security Updates: - CVE-2020-9281 Fixed XSS vulnerability in the HTML data processor reported by Micha Bentkowski of Securitum. Issue summary: It was possible to execute XSS inside CKEditor after persuading the victim to: i switch CKEditor to source mode, then ii paste a specially...

Mail.ru: relap.io CSRF bypass on adding domain to use relap widgets

The lack of CSRF protection in API endpoint in relap.io allowed to force user to add domain to the widget...

CVE-2020-9008

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

Cross site scripting

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

CVE-2020-9008

CVE-2020-9008 : Stored XSS in Blackboard Learn/PeopleTool v9.1 via the Tile widget in the People Tool profile editor. Root cause described in CNVD as lack of proper validation of client-side data. Impact per sources: ability to execute client-side code. No explicit remediation details are provide...

CVE-2020-9008

Stored Cross-site scripting XSS vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor...

CVE-2020-9382

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget as defined by this extension via MediaWiki's widget: parser function...

CVE-2020-9382

The CVE-2020-9382 entry refers to the MediaWiki Widgets extension (versions up to 1.4.0). The issue is due to improper title sanitization, allowing any wiki page to be executed as a widget via the {{#widget:}} parser function. Affected component: Widgets extension for MediaWiki; root cause: title...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to music/create, 2 location parameter to events/create, or 3 search parameter to widget/index/contentid/...

CVE-2012-6720

Multiple cross-site scripting XSS vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to music/create, 2 location parameter to events/create, or 3 search parameter to widget/index/contentid/...

CVE-2012-6720

Multiple cross-site scripting XSS vulnerabilities in SocialEngine before 4.2.4 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to music/create, 2 location parameter to events/create, or 3 search parameter to widget/index/contentid/...

Moderate: Red Hat Security Advisory: spice-gtk security update

An update for spice-gtk is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

VulnCheck KEV: CVE-2020-36875

AccessAlly WordPress plugin versions prior to 3.3.2 contain an unauthenticated arbitrary PHP code execution vulnerability in the Login Widget. The plugin processes the loginerror parameter as PHP code, allowing an attacker to supply and execute arbitrary PHP in the context of the WordPress web...

CVE-2019-20212

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form...

Cross site scripting

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form...

CVE-2019-20212

The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form...

Video on Admin Dashboard < 1.1.4 - Authenticated Stored XSS

Video on Admin Dashboard is vulnerable to stored XSS. When a user has admin capabilities, malicious code can be submitted through the plugin's options. A user can insert a simple script in the Widget Title text field, e.g. "alert'XSS';. Every specified user role by the plugin will now be targeted...

CityBook < 2.3.4 - Multiple Vulnerabilities

Multiple vulnerabilities was discovered in the 'CityBook - Directory & Listing WordPress Theme', tested version — v2.3.3: - Unauthenticated Reflected XSS - Authenticated Persistent XSS - IDOR Edit WPScanTeam: December 27h, 2019 - Envato Contacted January 6th, 2020 - Envato Investigating January...

PT-2020-18973 · Mediawiki · Wikibasemediainfo

Name of the Vulnerable Software and Affected Versions: WikibaseMediaInfo extension version 1.35 Description: The issue arises from improper template syntax within the PropertySuggestionsWidget template, specifically in the templates/search/PropertySuggestionsWidget.mustache+dom file, allowing for...

CVE-2019-15591

An improper access control vulnerability exists in GitLab 12.3.3 that allows an attacker to obtain container and dependency scanning reports through the merge request widget even though public pipelines were disabled...