CWE-83

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40.

Wtyczka Business Links dla Grafana umożliwia użytkownikowi z uprawnieniami Editor wstrzyknięcie dowolnego kodu JavaScript poprzez pole URL, co prowadzi do eskalacji uprawnień do poziomu Administrator. Podatność jest krytyczna, ponieważ pozwala przejąć pełną kontrolę administracyjną nad instancją Grafana.

Podatność w module XWiki Rendering pozwala na wstrzyknięcie dowolnego kodu HTML (XSS) poprzez nieprawidłowe nazwy atrybutów podczas renderowania XHTML. W przypadku użytkownika z uprawnieniami programistycznymi atak może prowadzić do wykonania kodu po stronie serwera, co zagraża poufności, integralności i dostępności całej instancji XWiki.

XWiki Platform przed wersją 14.6-rc-1 nie weryfikowała niebezpiecznych atrybutów i wartości atrybutów podczas renderowania HTML, co umożliwiało ataki cross-site scripting (XSS). Podatność jest oceniona jako krytyczna (CVSS 9.0) i pozwala atakującemu na przejęcie kontroli nad sesją ofiary lub wykonanie złośliwego kodu w kontekście przeglądarki.

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 2.2.0 through 2.54.0, an attacker is able to execute arbitrary JavaScript in a victim user's CVAT UI session, provided that they are able to create a maliciously crafted label in a CVAT task or project, then get the victim user to either edit that label, or view a shape that refers to that label; and/or get the victim user to upload a maliciously crafted SVG image when configuring a skeleton. This gives the attacker temporary access to all CVAT resources that the victim user can access. Version 2.55.0 fixes the issue.

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.

An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom Firefox scheme. This vulnerability affects Firefox for iOS < 123.

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as `<svg>`, `<math>` and `<noscript>`. This behavior deviates from how web browsers parse and interpret such tags. Specifically, content in CSS comments is ignored by lxml_html_clean but may be interpreted differently by web browsers, enabling malicious scripts to bypass the cleaning process. This vulnerability could lead to Cross-Site Scripting (XSS) attacks, compromising the security of users relying on lxml_html_clean in default configuration for sanitizing untrusted HTML content. Users employing the HTML cleaner in a security-sensitive context should upgrade to lxml 0.4.0, which addresses this issue. As a temporary mitigation, users can configure lxml_html_clean with the following settings to prevent the exploitation of this vulnerability. Via `remove_tags`, one may specify tags to remove - their content is moved to their parents' tags. Via `kill_tags`, one may specify tags to be removed completely. Via `allow_tags`, one may restrict the set of permissible tags, excluding context-switching tags like `<svg>`, `<math>` and `<noscript>`.

W systemie zarządzania treścią Kirby (wersje przed 4.9.4 i 5.4.4) możliwe było osadzenie skryptowego linku (np. javascript:) w komponencie writer field, co umożliwiało atak self cross-site scripting w panelu administracyjnym. Podatność dotyczy każdej instalacji Kirby korzystającej z pola writer w blueprintach.

Jodit Editor w wersjach wcześniejszych niż 4.12.28 zawiera podatność klasy Mutation XSS, umożliwiającą obejście wbudowanego sanitizera HTML. Atakujący może wstrzyknąć złośliwy kod JavaScript, który przeżyje proces czyszczenia HTML i zostanie wykonany bez żadnej interakcji użytkownika.

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor was allowing users to modify rich text fields with HTML without running any backend HTML cleaners thus allowing malicious actors to perform stored XSS attacks on dashboards and storefronts. Malicious staff members could craft script injections to target other staff members, possibly stealing their access and/or refresh tokens. This issue has been patched in versions 3.22.27, 3.21.43, and 3.20.108. In case of inability to upgrade straight away, a possible workaround is to use client-side cleaner.

Stored cross-site scripting (XSS) vulnerability in the LMT Dashboard of the Perx Customer Engagement & Loyalty Platform allows an authenticated attacker to execute arbitrary JavaScript code in a victim's browser. The vulnerability is due to improper sanitization of SVG file uploads. An attacker can upload a malicious SVG file containing a script payload to a campaign. When another user views this image on the public LMT microsite, the script executes, which can lead to session hijacking, data theft, or other unauthorized actions.This issue affects Customer Engagement & Loyalty Platform before 4.617.4.

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administrator to impersonate another legitimate authenticated PAN-OS administrator. The attacker must have network access to the management web interface to exploit this issue. You greatly reduce the risk of this issue by restricting access to the management web interface to only trusted internal IP addresses according to our recommended critical deployment guidelines https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431 . This issue does not affect Cloud NGFW and all Prisma® Access instances.

Podatność stored XSS w Simple Machines Forum v2.1.6 pozwala atakującym wykonywać dowolne skrypty internetowe lub kod HTML poprzez wstrzyknięcie zagrożliwego payload'u w parametr Forum Name.

Improper Neutralization of Script in Attributes in a Web Page vulnerability in Forcepoint Email Security (Blocked Messages module) allows Stored XSS. This issue affects Email Security through 8.5.5.

Concrete CMS 9.5.0 i niższe są podatne na Reflected XSS w Legacy Pagination przez HTML attribute injection. Klasa Concrete\Core\Legacy\Pagination konstruuje linki paginacji poprzez bezpośrednie interpolowanie pola $URL do atrybutu href="" (<a href="{$linkURL}" …>). Każdy uwierzytelniony admin lub użytkownik z dostępem do raportów z dostępem do `/dashboard/reports/forms/legacy`, który kliknie spreparowany URL, wyzwoli payload w swojej sesji. Zespół bezpieczeństwa Concrete CMS przyznał tej podatności CVSS v.4.0 score 6.0 z wektorem CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N.

An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and execute arbitrary commands. The security risk posed by this issue is significantly minimized when CLI access is restricted to a limited group of administrators. Cloud NGFW and Prisma® Access are not affected by this vulnerability.

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or newlines to bypass filtering and execute attacker-controlled script when a victim clicks a stored link rendered by an application. This issue is fixed in version 4.12.31.

Nuxt to otwarty framework do tworzenia aplikacji webowych opartych na Vue.js. W wersjach od 3.4.3 do 3.21.5 oraz od 4.0.0-alpha.1 do 4.4.5 funkcja navigateTo() z parametrem external: true generuje HTML redirect zawierający tag `<meta http-equiv="refresh">`. URL docelowy jest sanityzowany tylko poprzez zastąpienie znaku " na %22, pozostawiając znaki <, >, & i ' bez kodowania. Atakujący mogący wpłynąć na URL przekazany do navigateTo(url, { external: true }) może wyjść poza atrybut content="…" i wstrzyknąć arbitralny HTML/JavaScript wykonywany w ramach origin aplikacji. Problem został naprawiony w wersjach 3.21.6 i 4.4.6.

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.