CWE-79

Brak sanitizacji manifestu aplikacji w urządzeniach Azure-Access BLU-IC2 i BLU-IC4 umożliwia przeprowadzenie ataku stored XSS. Podatność otrzymała maksymalny wynik CVSS 10.0, co czyni ją krytycznym zagrożeniem dla środowisk korzystających z tych urządzeń.

Wtyczka TC Testimonials dla WordPressa w wersji do 1.1.1 zawiera podatność typu Stored XSS, umożliwiającą przechowywanie złośliwego kodu skryptowego po stronie serwera. Podatność otrzymała maksymalny wynik CVSS 10.0, co czyni ją wyjątkowo niebezpieczną.

Biblioteka DOMPurify zawierała podatność typu mutation XSS (mXSS), umożliwiającą ominięcie mechanizmu sanityzacji HTML. Ze względu na maksymalny wynik CVSS (10.0) i brak wymagań dotyczących uwierzytelnienia, zagrożenie jest krytyczne dla wszystkich aplikacji webowych korzystających z tej biblioteki.

W Gitea Open Source Git Server w wersji 1.22.0 wykryto podatność typu Stored XSS (Cross-site Scripting), polegającą na nieprawidłowej neutralizacji danych wejściowych podczas generowania stron internetowych. Podatność otrzymała maksymalny wynik CVSS 10.0, co wskazuje na krytyczne ryzyko dla organizacji korzystających z tej wersji.

com.xwiki.identity-oauth:identity-oauth-ui is a package to aid in building identity and service providers based on OAuth authorizations. When a user logs in via the OAuth method, the identityOAuth parameters sent in the GET request is vulnerable to cross site scripting (XSS) and XWiki syntax injection. This allows remote code execution via the groovy macro and thus affects the confidentiality, integrity and availability of the whole XWiki installation. The issue has been fixed in Identity OAuth version 1.6. There are no known workarounds for this vulnerability and users are advised to upgrade.

Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit.

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.7 contains a patch for this issue. As a workaround, disable native inventory.

Due to improper input sanitization of user-controlled input in SAP BusinessObjects Business Intelligence Platform CMC application - versions 420, and 430, an attacker with basic user-level privileges can modify/upload crystal reports containing a malicious payload. Once these reports are viewable, anyone who opens those reports would be susceptible to stored XSS attacks. As a result of the attack, information maintained in the victim's web browser can be read, modified, and sent to the attacker.

All versions of CEVAS prior to 1.01.46 do not sufficiently validate user-controllable input and could allow a user to bypass authentication and retrieve data with specially crafted SQL queries.

Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.

The web server is vulnerable to reflected XSS and therefore an attacker might be able to execute scripts on a client’s computer by sending the client a manipulated URL.

remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is, user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation. On older affected versions, pass `sanitize: true` if you cannot update.

The Jupyter notebook is a web-based notebook environment for interactive computing. In affected versions untrusted notebook can execute code on load. Jupyter Notebook uses a deprecated version of Google Caja to sanitize user inputs. A public Caja bypass can be used to trigger an XSS when a victim opens a malicious ipynb document in Jupyter Notebook. The XSS allows an attacker to execute arbitrary code on the victim computer using Jupyter APIs.

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or documented. This allowed for any user to type malicious HTML markup within certain user input fields and have this execute on client browsers. The example which led to the discovery of this vulnerability was in the forum search box. Entering faux-malicious HTML markup, such as <script>alert('test')</script> resulted in an alert box appearing on the forum. This attack could also be modified to perform AJAX requests on behalf of a user, possibly deleting discussions, modifying their settings or profile, or even modifying settings on the Admin panel if the attack was targetted towards a privileged user. All Flarum communities that run flarum v1.0.0 or v1.0.1 are impacted. The vulnerability has been fixed and published as flarum/core v1.0.2. All communities running Flarum v1.0 have to upgrade as soon as possible to v1.0.2.

The extension subsystem in Google Chrome before 17.0.963.78 does not properly handle history navigation, which allows remote attackers to execute arbitrary code by leveraging a "Universal XSS (UXSS)" issue.

SiYuan przed wersją 3.7.0 zawiera podatność stored XSS w komponencie Attribute View (widok bazy danych), która w kliencie desktopowym opartym na Electron eskaluje do pełnego remote code execution (RCE). Ze względu na architekturę Electron, gdzie kod JavaScript ma dostęp do API systemowego, podatność XSS pozwala atakującemu na wykonanie dowolnego kodu na maszynie ofiary.

Podatność w systemie SiYuan (przed wersją 3.7.0) pozwala na wstrzyknięcie dowolnego kodu JavaScript przez złośliwie spreparowany snippet CSS. Na komputerach z aplikacją desktopową opartą na Electron atak eskaluje do pełnego RCE na hoście, ponieważ renderer działa z włączoną opcją nodeIntegration.

W systemie SiYuan do wersji 3.7.0 istnieje podatność typu XSS w komponencie renderującym komórki bazy danych (attribute-view), umożliwiająca wykonanie dowolnego kodu JavaScript. Na wersji desktopowej (Electron) podatność eskaluje bezpośrednio do RCE na poziomie systemu operacyjnego z powodu włączonej opcji nodeIntegration.

Krytyczna podatność typu XSS w hackage-server (w tym hackage.haskell.org) pozwala złośliwemu maintainerowi pakietu na serwowanie dowolnych plików HTML i JavaScript w kontekście głównej domeny. W efekcie możliwe jest przejęcie sesji uwierzytelnionego użytkownika i wykonanie dowolnych działań w jego imieniu.