CVE-2022-30278

A vulnerability in Black Duck Hub’s embedded MadCap Flare documentation files could allow an unauthenticated remote attacker to conduct a cross-site scripting attack. The vulnerability is due to improper validation of user-supplied input to MadCap Flare's framework embedded within Black Duck Hub's Help Documentation to supply content. An attacker could exploit this vulnerability by convincing a user to click a link designed to pass malicious input to the interface. A successful exploit could allow the attacker to conduct cross-site scripting attacks and gain access to sensitive browser-based information.

• CWE-79
• CWE-79

• https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/Vendor Advisory
• https://www.synopsys.com/blogs/software-security/cyrc-advisory-cross-site-scripting-vulnerability-black-duck-hub/Vendor Advisory

Published

May 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-30272The Motorola ACE1000 RTU through 2022-05-02 mishandles firmw…7.2
• CVE-2022-30273The Motorola MDLC protocol through 2022-05-02 mishandles mes…9.8
• CVE-2022-30274The Motorola ACE1000 RTU through 2022-05-02 uses ECB encrypt…9.8
• CVE-2022-30275The Motorola MOSCAD Toolbox software through 2022-05-02 reli…7.5
• CVE-2022-30276The Motorola MOSCAD and ACE line of RTUs through 2022-05-02 …7.5
• CVE-2022-30277BD Synapsys™, versions 4.20, 4.20 SR1, and 4.30, contain an …5.7
• CVE-2022-30279An issue was discovered in Stormshield Network Security (SNS…7.5
• CVE-2022-3028A race condition was found in the Linux kernel's IP framewor…7
• CVE-2022-30280/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 a…8.8
• CVE-2022-30283In UsbCoreDxe, tampering with the contents of the USB workin…7.5
• CVE-2022-30284In the python-libnmap package through 0.7.2 for Python, remo…9.8
• CVE-2022-30285In Quest KACE Systems Management Appliance (SMA) through 12.…9.8