Rodolfo Tavares

تؤدي علامات التهرب غير الصحيحة في مخرجات ترميز schema.org إلى إنشاء ثغرة أمنية من نوع «التنفيذ البرمجي عبر المواقع» (XSS). XSS هو ثغرة أمنية تسمح للمهاجم بإدخال نصوص برمجية ضارة في صفحات الويب التي يشاهدها مستخدمون آخرون.

The issue arises from Bruno's use of Electron's `shell.openExternal` function without proper validation of URLs, specifically `http` or `https`, when opening windows within the Markdown docs viewer. This lack of validation can lead to unvalidated URL handling.

A cross-site scripting (XSS) issue in the UrlAccessibilityEvaluation.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `contentHtml` parameter.

A hardcoded privileged ID allows attackers to bypass authentication and access internal pages and other sensitive information.

A cross-site scripting (XSS) issue in the main.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `pageId` parameter.

A cross-site scripting (XSS) issue in the XsltResultControllerHtml.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `lumPageID` parameter.

The issue allows high privilege users to read any file from the web server via a Traversal attack due to the plugin not sanitising and validating a parameter before using it to read the content of a file.