For example, an attacker could recover the email address tied to the Canarytoken, or place Javascript on the history page that redirect the creator towards an attacker-controlled Canarytoken to show the creator's network location. It might also be used as a stepping stone towards revealing more information about the Canarytoken's creator to the attacker. This vulnerability could be used to disable or delete the affected Canarytoken, or view its activation history. This permits an attacker who recognised an HTTP-based Canarytoken (a URL) to execute Javascript in the Canarytoken's history page (domain: ) when the history page is later visited by the Canarytoken's creator. A Cross-Site Scripting vulnerability was identified in the history page of triggered Canarytokens. There are no known workarounds for this issue.Ĭanarytokens is an open source tool which helps track activity and actions on your network. It is recommended that the HumHub is upgraded to 1.11.4, 1.10.5. The names of individual "spaces" are not properly escaped and so an attacker with sufficient privilege could insert malicious javascript into a space name and exploit system users who visit that space. For exploitation, the attacker would need a permission to administer the Spaces feature. Affected versions of HumHub are vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. HumHub is an Open Source Enterprise Social Network. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`. The bug has been patched in jQuery UI 1.13.2. This can lead to potentially executing JavaScript code. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. JQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. There are no known workarounds for this issue. The problem has been recognized and patched. This vulnerability might affect a small percent of integrators that depend on dynamic editor initialization/destroy and use Markdown, General HTML Support or HTML embed features. The root cause of the issue was a mechanism responsible for updating the source element with the markup coming from the CKEditor 5 data pipeline after destroying the editor. Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.Ī reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (` as a base. Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script. Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/admin_notifiers/rules.php and /module/report_event/indext.php via the parameters rule_notification, rule_name, and rule_name_old, and at /module/admin_user/add_modify_user.php via the parameters user_name and user_email. Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names. An annotation can be added to a GitopsCluster custom resource. The exposure appears in Weave GitOps Enterprise UI via a GitopsCluster dashboard link. When clicked by a victim user, the script will execute with the victim's permission. Weave GitOps Enterprise before 0.9.0-rc.5 has a cross-site scripting (XSS) bug allowing a malicious user to inject a javascript: link in the UI.
0 kommentar(er)
