Wstrzyknięcie skryptów w Drupal umożliwia ataki typu Cross-Site Scripting.
Wstrzyknięcie skryptów w Drupal umożliwia ataki typu Cross-Site Scripting.
- CVSS
- 6,1
- EPSS
- 0,24 %
- Poprawka
- Status poprawki nieustalony
- Publikacja
- Aktualizacja NVD
KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Wstrzyknięcie skryptów w Drupal umożliwia ataki typu Cross-Site Scripting.
W Drupal avatar_uploader występuje XSS, co pozwala na wstrzyknięcie złośliwych skryptów.
Odbicie ataku XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary.
Wykorzystanie przepełnienia bufora w Zulip umożliwia odczyt dowolnych plików z systemu.
Luka XSS w Znuny::ITSM 6.5.x pozwala na wykonanie złośliwego kodu przez OTRSCustomerInterface.
Brak sanitizacji w ui.markdown NiceGUI umożliwia ataki XSS przez wstrzyknięcie złośliwego HTML.
Brak sanitizacji zawartości tagu template w HtmlSanitizer może prowadzić do ataków XSS.
Luka Open Redirect w Qwik umożliwia atakującym przekierowanie użytkowników na złośliwe strony.
Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited…
Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted…
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI…
Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.…
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD…
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards…
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD…
Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft…
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base. Successful attacks…
Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Purchasing. Successful…
Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning.…
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.…
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful…
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Wstrzyknięcie skryptów w Drupal umożliwia ataki typu Cross-Site Scripting. | Wstrzyknięcie skryptów w Drupal umożliwia ataki typu Cross-Site Scripting. |
Do wiadomości | 6,1 | 0,24 % | ||
| W Drupal avatar_uploader występuje XSS, co pozwala na wstrzyknięcie złośliwych skryptów. | W Drupal avatar_uploader występuje XSS, co pozwala na wstrzyknięcie złośliwych skryptów. |
Do wiadomości | 6,1 | 0,24 % | ||
| Odbicie ataku XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary. | Odbicie ataku XSS w Adobe Connect pozwala na wykonanie złośliwego kodu w przeglądarce ofiary. |
Do wiadomości | 6,1 | 0,24 % | ||
| Wykorzystanie przepełnienia bufora w Zulip umożliwia odczyt dowolnych plików z systemu. | Wykorzystanie przepełnienia bufora w Zulip umożliwia odczyt dowolnych plików z systemu. |
Do wiadomości | 6,1 | 0,24 % | ||
| Luka XSS w Znuny::ITSM 6.5.x pozwala na wykonanie złośliwego kodu przez OTRSCustomerInterface. | Luka XSS w Znuny::ITSM 6.5.x pozwala na wykonanie złośliwego kodu przez OTRSCustomerInterface. |
Do wiadomości | 6,1 | 0,24 % | ||
| Brak sanitizacji w ui.markdown NiceGUI umożliwia ataki XSS przez wstrzyknięcie złośliwego HTML. | Brak sanitizacji w ui.markdown NiceGUI umożliwia ataki XSS przez wstrzyknięcie złośliwego HTML. |
Do wiadomości | 6,1 | 0,24 % | ||
| Brak sanitizacji zawartości tagu template w HtmlSanitizer może prowadzić do ataków XSS. | Brak sanitizacji zawartości tagu template w HtmlSanitizer może prowadzić do ataków XSS. |
Do wiadomości | 6,1 | 0,24 % | ||
| Luka Open Redirect w Qwik umożliwia atakującym przekierowanie użytkowników na złośliwe strony. | Luka Open Redirect w Qwik umożliwia atakującym przekierowanie użytkowników na złośliwe strony. |
Do wiadomości | 6,1 | 0,24 % | ||
| Tornado is a Python web framework and asynchronous networking library. | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP headers (where it could be used for header injection) or in HTML in the default error page (where it could be used for XSS) and can be exploited… |
Do wiadomości | 6,1 | 0,24 % | ||
| Monkeytype is a minimalistic and customizable typing test. | Monkeytype is a minimalistic and customizable typing test. In 25.49.0 and earlier, there is improper handling of user input which allows an attacker to execute malicious javascript on anyone viewing a malicious quote submission. quote.text and quote.source are user input, and they're inserted… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). | Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). Supported versions that are affected are 25.12-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration.… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI). | Vulnerability in the Installed Base product of Oracle E-Business Suite (component: HTML UI). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Installed Base. Successful attacks… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). | Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Approvals). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Purchasing. Successful… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). | Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations). Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning.… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful… |
Do wiadomości | 6,1 | 0,24 % | ||
| Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful… |
Do wiadomości | 6,1 | 0,24 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.