漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
XSS vulnerability in JOC Cockpit branch 1.13
Vulnerability Description
JS7 is an Open Source Job Scheduler. Users specify file names when uploading files holding user-generated documentation for JOC Cockpit. Specifically crafted file names allow an XSS attack to inject code that is executed with the browser. Risk of the vulnerability is considered high for branch 1.13 of JobScheduler (JS1). The vulnerability does not affect branch 2.x of JobScheduler (JS7) for releases after 2.1.0. The vulnerability is resolved with release 1.13.19.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Cockpit 跨站脚本漏洞
Vulnerability Description
Cockpit是一个交互式服务器管理界面。 joc-cockpit 1.13.19之前版本存在跨站脚本漏洞，该漏洞源于用户在上传包含用户生成的 JOC Cockpit 文档的文件时需要指定文件名，攻击者利用该漏洞可以通过精心设计的文件名注入浏览器执行任意代码。
CVSS Information
N/A
Vulnerability Type
N/A