#xss

Contao version 4.13.2 suffers from a cross site scripting vulnerability.

Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.

siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).

A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.

Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and arbitrary code execution.

### Impact There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self. ### Patches Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev. ### Workarounds No need for workarounds. ### References N/A ### For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.

Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.

NetScout nGeniusONE 6.3.2 allows an XML External Entity (XXE) attack.

bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS.

BigBlueButton Greenlight 2.11.1 allows XSS. A threat actor could have a username containing a JavaScript payload. The payload gets executed in the browser of the victim in the "Share room access" dialog if the victim has shared access to the particular room with the attacker previously.