#cwe-79

共收录 5770 条相关情报。

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a Dashboard Studio workflow action with a crafted Un...

CVE-2026-76333

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could s

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaS...

CVE-2026-76326

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could store a malicious ui-tour knowledge object that matches an...

CVE-2026-76325

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could s

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary Jav...

CVE-2026-76324

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could c

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_search capability could store a malicious script in an alert t...

CVE-2026-76318

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user that holds a role with the schedule_searc

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user into visiting a malicious web page could run unauthorized...

CVE-2026-76252

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.13, an unauthenticated user who tricks another user

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Markdown in src/shared/markdown.ts for post bodies, comment b...

CVE-2026-54743

Lemmy is a link aggregator and forum for the fediverse. Prior to lemmy-ui 0.19.19-beta.1, LemmyNet/lemmy-ui renders Mark

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js read a card title and body through textContent, which decod...

CVE-2026-68900

Wekan is open source kanban built with Meteor. From 8.72 until 10.23, addBoardHTMLToZip() in client/lib/exportHTML.js re

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records returned ...

CVE-2026-67189

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffi

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plug...

CVE-2026-55090

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpola

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when s...

CVE-2026-55087

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-444 #cwe-601

漏洞预警2026-08-19 发布INFO

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an ...

CVE-2026-55085

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

安全公告2026-08-19 发布INFO

Snipe-IT: Stored DOM XSS via table selected-count IDs

CVE-2026-61807

### Impact The table component derives data-selected-count-id from the component $name value. On manufacturer and suppli

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-79 #severity:medium

漏洞预警2026-08-19 发布INFO

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the table component $name becomes data-selected-count-id in r...

CVE-2026-61807

Snipe-IT is an IT asset/license management system. Prior to 8.6.2, a stored manufacturer or supplier name passed as the

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core pass...

CVE-2026-64851

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordP

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in Handl...

CVE-2026-61607

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2,

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space administrator can delete another user's comment, choose to ...

CVE-2026-18430

HumHub 1.18.4 contains a stored cross-site scripting vulnerability in the comment-deletion notification flow. A Space ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the request was written unescaped into an XML attribute.

CVE-2026-75955

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3 - companyName from the r

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privil...

CVE-2026-54793

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Genera

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-08-19 发布INFO

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administra...

CVE-2026-40508

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler

历史摘要 · 未重新核验 · NVD

#cve #cwe-79