KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Luka w Telerik UI dla ASP.NET AJAX umożliwia atakującym przejęcie kluczy i ataki XSS.
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.
Wielokrotne podatności w interfejsie usług sieciowych Cisco ASA umożliwiają ataki XSS.
A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message.
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro.
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Wielokrotne podatności XSS w D-Link DSL-2760U umożliwiają zdalne wstrzykiwanie skryptów.
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the…
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Luka XSS w Zimbra Collaboration Suite umożliwia zdalne wstrzyknięcie skryptu przez załącznik.
Luka XSS w QNAP umożliwia zdalne wstrzykiwanie złośliwego kodu.
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit…
Luka w zarządzaniu ciasteczkami w Safari umożliwia atak typu cross-site scripting.
Luka XSS w stronie logowania WebVPN w Cisco ASA pozwala na zdalne wstrzyknięcie skryptu.
Przechowywane XSS w Zimbra Collaboration umożliwia atakującym wykonanie złośliwego kodu w wiadomościach e-mail.
Wstrzyknięcie skryptów w QNAP umożliwia zdalne wykonanie złośliwego kodu.
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails… | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. |
Pilne działanie | 9,3 | 82,88 % | ||
| Luka w Telerik UI dla ASP.NET AJAX umożliwia atakującym przejęcie kluczy i ataki XSS. | Luka w Telerik UI dla ASP.NET AJAX umożliwia atakującym przejęcie kluczy i ataki XSS. |
Pilne działanie | 9,8 | 75,1 % | ||
| Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted… | Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. |
Pilne działanie | 9,0 | 77,27 % | ||
| Wielokrotne podatności w interfejsie usług sieciowych Cisco ASA umożliwiają ataki XSS. | Wielokrotne podatności w interfejsie usług sieciowych Cisco ASA umożliwiają ataki XSS. |
Pilne działanie | 6,1 | 85,58 % | ||
| A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows… | A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site scripting and local file reading. Exploiting the vulnerability requires the victim to click a link preview from a specially crafted text message. |
Pilne działanie | 8,2 | 67,86 % | ||
| An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. | An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview. |
Pilne działanie | 6,1 | 76,6 % | ||
| Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. |
Pilne działanie | 6,1 | 73,3 % | ||
| The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url… | The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swp_debug=load_options swp_url parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro. |
Pilne działanie | 6,1 | 72,95 % | ||
| Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG… | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code. |
Pilne działanie | 5,4 | 75,87 % | ||
| Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because… | Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. |
Pilne działanie | 6,1 | 63,66 % | ||
| Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. | Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. |
Pilne działanie | 6,1 | 49,08 % | ||
| Wielokrotne podatności XSS w D-Link DSL-2760U umożliwiają zdalne wstrzykiwanie skryptów. | Wielokrotne podatności XSS w D-Link DSL-2760U umożliwiają zdalne wstrzykiwanie skryptów. |
Pilne działanie | 5,4 | 50,83 % | ||
| An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute… | An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt Strike teamserver. To exploit the vulnerability, one must first inspect a Cobalt Strike payload, and then modify the username field in the… |
Pilne działanie | 6,1 | 46,45 % | ||
| OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. | OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm. |
Pilne działanie | 5,4 | 48,05 % | ||
| An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php. |
Pilne działanie | 6,1 | 32,92 % | ||
| Luka XSS w Zimbra Collaboration Suite umożliwia zdalne wstrzyknięcie skryptu przez załącznik. | Luka XSS w Zimbra Collaboration Suite umożliwia zdalne wstrzyknięcie skryptu przez załącznik. |
Pilne działanie | 6,1 | 29,76 % | ||
| Luka XSS w QNAP umożliwia zdalne wstrzykiwanie złośliwego kodu. | Luka XSS w QNAP umożliwia zdalne wstrzykiwanie złośliwego kodu. |
Pilne działanie | 6,1 | 28,98 % | ||
| Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG… | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. |
Pilne działanie | 6,1 | 26,84 % | ||
| An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit… |
Pilne działanie | 6,1 | 23,63 % | ||
| Luka w zarządzaniu ciasteczkami w Safari umożliwia atak typu cross-site scripting. | Luka w zarządzaniu ciasteczkami w Safari umożliwia atak typu cross-site scripting. |
Pilne działanie | 6,3 | 22,59 % | ||
| Luka XSS w stronie logowania WebVPN w Cisco ASA pozwala na zdalne wstrzyknięcie skryptu. | Luka XSS w stronie logowania WebVPN w Cisco ASA pozwala na zdalne wstrzyknięcie skryptu. |
Pilne działanie | 6,1 | 22,56 % | ||
| Przechowywane XSS w Zimbra Collaboration umożliwia atakującym wykonanie złośliwego kodu w wiadomościach e-mail. | Przechowywane XSS w Zimbra Collaboration umożliwia atakującym wykonanie złośliwego kodu w wiadomościach e-mail. |
Pilne działanie | 6,1 | 20,23 % | ||
| Wstrzyknięcie skryptów w QNAP umożliwia zdalne wykonanie złośliwego kodu. | Wstrzyknięcie skryptów w QNAP umożliwia zdalne wykonanie złośliwego kodu. |
Pilne działanie | 5,4 | 21,48 % | ||
| A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0… | A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters. |
Pilne działanie | 6,1 | 17,63 % | ||
| An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with… | An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript code in the context of a webmail user's browser window. |
Pilne działanie | 6,1 | 17,59 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.