The suggestion text (a parameter to mediasearch-did-you-mean) was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the intitle: search operator within the query.Īn issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-overview-add-filter-total-edits-headline, growthexperiments-mentor-dashboard-mentee-overview-add-filter-starred-headline, growthexperiments-mentor-dashboard-mentee-overview-info-text, growthexperiments-mentor-dashboard-mentee-overview-info-legend-headline, and growthexperiments-mentor-dashboard-mentee-overview-active-ago MediaWiki messages were not being properly sanitized and allowed for the injection and execution of HTML and JavaScript.Īn issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and allowed for users to inject HTML and JavaScript.Īn issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2.
MICROSOFT OUTLOOK FOR MAC 16.9 COLOR SUBJECT LINE IN EMAILS CODE
Any admin can add arbitrary JavaScript code to the Newcomer home page footer, which can be executed by viewers with zero edits.Īn issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.Īn issue was discovered in the Growth extension in MediaWiki through 1.36.2. The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After obtaining a user’s privilege, remote attackers can inject JavaScript and execute stored XSS attack.
Easytest bulletin board management function of online learning platform does not filter special characters.
0 kommentar(er)
