Blog

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI, as demonstrated by a crafted e-mail address.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.

ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.

In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView’s JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.

The Canon Oce Colorwave 500 4.0.0.0 printer’s web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform administrative actions by targeting a logged-in administrative user. NOTE: this is fixed in the latest version.

In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33.