PT-2020-9945

Name of the Vulnerable Software and Affected Versions Moodle versions 3.7.2 and earlier Description The issue allows authenticated users, such as those with a Teacher role or above, to inject JavaScript into another user's session, including enrolled students or site administrators, via the...

FreeBSD : wordpress -- multiple issues (459df1ba-051c-11ea-9673-4c72b94353b5)

wordpress developers reports : Props to Evan Ricafort for finding an issue where stored XSS cross-site scripting could be added via the Customizer. rops to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts. Props to Weston Ruter for finding a way to create a stored XSS...

GHSA-XV69-F7X5-R4QW Magento Cross-Site Scripting via Attribute Set Name

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products...

IBM Cognos Analytics Cross-Site Scripting Vulnerability (CNVD-2019-40462)

IBM Cognos Analytics is a suite of business intelligence software from IBM USA that provides you with valuable information, secure data governance and reporting. A cross-site scripting vulnerability exists in IBM Cognos Analytics versions 11.0 through 11.1, which can be exploited by a remote...

PT-2019-17098

Name of the Vulnerable Software and Affected Versions IBM QRadar versions 7.3.0 through 7.3.2 Patch 4 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2019-17090

Name of the Vulnerable Software and Affected Versions IBM QRadar versions 7.3.0 through 7.3.2 Patch 4 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Portainer Cross-Site Scripting Vulnerability (CNVD-2019-40484)

Portainer is an open source lightweight management UI that allows you to easily manage docker hosts or clusters. A stored cross-site scripting vulnerability exists in the isteven-multi-select component in Portainer versions prior to 1.22.1. An attacker can exploit this vulnerability to inject...

Magento cross-site scripting vulnerability (CNVD-2019-40736)

Magento is an open source PHP e-commerce system from the U.S. company Magento. A cross-site scripting vulnerability exists in Magento. An attacker can exploit this vulnerability to inject malicious JavaScript into the management console cache...

CVE-2019-8227

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML...

CVE-2019-8228

in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via customer attribute label...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder...

Magento cross-site scripting vulnerability (CNVD-2019-40833)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. Magento 2.2 version and 2.3 version of a security vulnerability , the vulnerability stems from the cleaning engin...

Magento Cross-Site Scripting Vulnerability (CNVD-2019-40835)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. A security vulnerability exists in Magento versions prior to 1.9.4.3 and prior to 1.14.4.3. An attacker can explo...

CVE-2019-8227: Improper Neutralization of Input During Web Page Generation

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML...

CVE-2019-8228

in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template...

CVE-2019-8228

in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template...

CVE-2019-8148

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specification...

PT-2019-18942

Name of the Vulnerable Software and Affected Versions Magento versions prior to 1.9.4.3 Magento versions prior to 1.14.4.3 Description The issue allows an authenticated user with limited administrative privileges to inject arbitrary JavaScript code into the transactional email page when creating ...