CVE Vulnerability Catalog

An XSS vulnerability in TinyMCE before version 5.10.0 allows a remote, unauthenticated attacker to inject malicious JavaScript via crafted image or link URLs. The code executes in the browser of a user editing content.

Stored XSS vulnerability in TinyMCE before version 5.9.0. An unauthenticated remote attacker can inject crafted HTML into the editor, leading to arbitrary JavaScript execution in another user's browser.

The GroovyEngine.execute component in jline-groovy v3.24.1 contains an issue that allows attackers to cause an Out of Memory (OOM) error.

A cross-site scripting (XSS) vulnerability exists in the admin_ Video.php component of SeaCMS v12.8. It allows attackers to execute arbitrary web scripts or HTML via a crafted payload.

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt", which could be used to bypass the security patch implemented to address CVE-2023-6134.

In ssh-agent in OpenSSH before 9.6, destination constraints can be incompletely applied when adding PKCS#11-hosted private keys. Constraints are only applied to the first key, even if the PKCS#11 token returns multiple keys.

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

The 'Create a Space' feature in Silverpeas Core 6.3.1 is reserved for administrators but suffers from broken access control, allowing any authenticated user to create a space by navigating to the correct URL.

A vulnerability in Silverpeas Core 6.3.1 administrative 'Bin' feature allows a low-privileged user to access the bin, revealing all deleted spaces. The user can then restore or permanently delete these spaces.

Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. An attacker can inject malicious JavaScript code into message content.

Silverpeas Core 6.3.1 has an incorrect access control vulnerability in the 'Porlet Deployer' component, allowing administrators to deploy .WAR portlets. This could lead to unauthorized code execution or privilege escalation.

A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

A vulnerability in the AnyConnect SSL VPN feature of Cisco ASA and FTD could allow an authenticated, remote attacker to send packets with another VPN user's source IP address. This is due to improper validation of the packet's inner source IP after decryption.

DedeCMS v5.7.111 was found to have a reflective cross-site scripting (XSS) vulnerability in the select_media_post_wangEditor.php component. An attacker can inject malicious JavaScript code into a request, which will be executed in the victim's browser.

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information.

In CPython 3.12.0 in the subprocess module on POSIX platforms, when the extra_groups=[] parameter is used, the process does not call setgroups(0, NULL) before exec(), causing the new process to inherit the parent process's groups. This issue was fixed in CPython 3.12.1 and only affects processes run with root privileges.

A flaw was found in Quarkus Cache Runtime. When request processing uses a Uni cached with @CacheResult and the cached Uni reuses the initial 'completion' context, the processing switches to the cached Uni instead of the request context. This can allow a malicious user to receive a response meant for another user, gaining access to sensitive data.

A stored cross-site scripting (XSS) vulnerability was discovered in DaiCuo version 2.5.15 in the /admin.php file. Attackers can inject malicious JavaScript or HTML via crafted input.

In MISP before version 2.4.179, there is an XSS vulnerability in the event timeline widget located in app/Lib/Tools/EventTimelineTool.php.