8950 matches found
PT-2021-22375 · Atlassian · Atlasboard
Name of the Vulnerable Software and Affected Versions: Atlasian Atlasboard versions prior to 1.1.9 Description: The issue allows remote attackers to read arbitrary files via a path traversal vulnerability in the renderWidgetResource resource. Recommendations: For versions prior to 1.1.9, update t...
CVE-2021-20814
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, and Movable Type Premium 1.44 and earlier allows remote...
CVE-2021-20814
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, and Movable Type Premium 1.44 and earlier allows remote...
Cross site scripting
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, and Movable Type Premium 1.44 and earlier allows remote...
CVE-2021-20814
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, and Movable Type Premium 1.44 and earlier allows remote...
CVE-2021-20814
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, and Movable Type Premium 1.44 and earlier allows remote...
CVE-2021-20814
CVE-2021-20814 is a Cross-site scripting vulnerability in Movable Type’s ContentType Information Widget Plugin “Setting” screen. The issue affects Movable Type 7 (r.4903 and earlier), Movable Type Advanced 7 (r.4903 and earlier), and Movable Type Premium 1.44 and earlier, where an attacker can in...
CVE-2021-20814: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Setting screen of ContentType Information Widget Plugin of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, and Movable Type Premium 1.44 and earlier allows remote...
PT-2021-14268
Name of the Vulnerable Software and Affected Versions: Movable Type versions 7 r.4903 and earlier Movable Type Advanced versions 7 r.4903 and earlier Movable Type Premium version 1.44 and earlier Description: A cross-site scripting issue in the Setting screen of the ContentType Information Widget...
Multiple cross-site scripting vulnerabilities in Movable Type
Overview Movable Type provided by Six Apart Ltd. contains multiple cross-site scripting vulnerabilities listed below. Cross-site scripting vulnerability in Search screen CWE-79 - CVE-2021-20808 Cross-site scripting vulnerability in Create screens of Entry, Page, and Content Type CWE-79 -...
Cross-Site Request Forgery (CSRF) in namelessmc/nameless
✍️ Description Attacker able to disable any widget with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF attacks...
JetBrains Hub Encryption Issue Vulnerability
JetBrains Hub is a web-based application from JetBrains Czech Republic. The application is capable of integrating multiple JetBrains team tools together. An encryption issue vulnerability exists in versions prior to JetBrains Hub 2021.1.13262, which stems from the fact that the CSP used by the...
GHSA-6226-H7FF-CH6C Widget feature vulnerability allowing to execute JavaScript code using undo functionality
Affected packages The vulnerability has been discovered in Widget plugin if used alongside Undo feature. Impact A potential vulnerability has been discovered in CKEditor 4 Widget package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in...
Widget feature vulnerability allowing to execute JavaScript code using undo functionality
Affected packages The vulnerability has been discovered in Widget plugin if used alongside Undo feature. Impact A potential vulnerability has been discovered in CKEditor 4 Widget package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in...
Widget feature vulnerability allowing to execute JavaScript code using undo functionality
Affected packages The vulnerability has been discovered in Widget plugin if used alongside Undo feature. Impact A potential vulnerability has been discovered in CKEditor 4 Widget package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in...
Django has an unspecified vulnerability (CNVD-2021-68758)
Django is the Django Foundation's set of Python-based language open source Web application framework . Django-Widgy version 0.8.4 contains a security vulnerability that can be exploited by remote attackers to execute arbitrary code via the "image" widget in the component "Change Widgy Page"...
CVE-2021-39250
Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...
VulnCheck KEV: CVE-2019-3369
Atlassian Confluence and Data Center is vulnerable to a remote code execution vulnerability in the 'widget connector' component. The issue lies in a server-side template injection weakness...
PYSEC-2021-336
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'...