PYSEC-2022-42970

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

CVE-2022-43982 Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URL

In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the origin query argument...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to Node.js vulnerabilities (CVE-2022-35256 and CVE-2022-35255)

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to CVE-2022-35256 and CVE-2022-35255 for Node.js with details below Vulnerability Details CVEID:CVE-2022-35256 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to...

CVE-2022-39017 XSS in all comments fields in M-Files Hubshare

Improper input validation and output encoding in all comments fields, in M-Files Hubshare before 3.3.10.9 allows authenticated attackers to introduce cross-site scripting attacks via specially crafted comments...

Samsung Galaxy Store Bug Could've Let Hackers Secretly Install Apps on Targeted Devices

A now-patched security flaw has been disclosed in the Galaxy Store app for Samsung devices that could potentially trigger remote command execution on affected phones. The vulnerability, which affects Galaxy Store version 4.5.32.4, relates to a cross-site scripting XSS bug that occurs when handlin...

Security Bulletin: A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation

Summary A security vulnerability in Node.js affects IBM Cloud Pak for Watson AIOps Infrastructure Automation Vulnerability Details CVEID:CVE-2022-32215 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly handle multi-line Transfer-Encoding headers by t...

The vulnerability in the implementation of the editPerson.action and struts2-rest-showcase/orders scripts on the Apache Struts software platform allows an attacker to perform XSS attacks.

The vulnerability of the editPerson.action and struts2-rest-showcase/orders implementations on the Apache Struts software platform exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows an attacker to execute XSS attacks by using the...

GHSA-CVXJ-4745-843X Content-Security-Policy protection for user content disabled by Jenkins ScreenRecorder Plugin

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. ScreenRecorder Plugin 0.7 and earlier programmatically updates the Java system...

GHSA-PX4X-HJM5-W8X3 Content-Security-Policy protection for user content disabled by Jenkins XFramium Builder Plugin

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. XFramium Builder Plugin 1.0.22 and earlier globally disables the...

GHSA-WMFH-H3VM-RCXM Content-Security-Policy protection for user content disabled by Jenkins NeuVector Vulnerability Scanner Plugin

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. NeuVector Vulnerability Scanner Plugin 1.20 and earlier globally disables the...

Content-Security-Policy protection for user content can be disabled in Jenkins 360 FireLine Plugin

Jenkins sets the Content-Security-Policy header to static files served by Jenkins specifically DirectoryBrowserSupport, such as workspaces, /userContent, or archived artifacts, unless a Resource Root URL is specified. 360 FireLine Plugin 1.7.2 and earlier globally disables the...

CVE-2022-3132

The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2022-23711 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform versions prior to 2022.3.0 Description: The issue is related to insufficient sanitization of inputs in the QoE application input field, which could lead to stored and DOM-based XSS attacks. Recommendations: For versions...

SolarWinds Orion Platform < 2022.3 Multiple Vulnerabilities

The version of SolarWinds Orion Platform installed on the remote host is prior to 2022.3. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20223 advisory. - A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated...

SUSE SLED15: MozillaFirefox / MozillaFirefox-branding-SLE / etc (SUSE-SU-2022:3396-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:3396-1 advisory. Mozilla Firefox was updated to 102.3.0esr ESR bsc1200793, bsc1201758, bsc1202645, bsc1203477: -...

Jodit Editor vulnerable to Cross-site Scripting

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds...

Design/Logic Flaw

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds...

CVE-2022-23461 Cross-Site Scripting (XSS) in Jodit Editor

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds...

CVE-2022-23461 Cross-Site Scripting (XSS) in Jodit Editor

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds...

CVE-2022-23461 Cross-Site Scripting (XSS) in Jodit Editor

Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting specially constructed input. This issue has not been fully patched. There are no known workarounds...