681 matches found
PT-2020-20178
Name of the Vulnerable Software and Affected Versions GistPress plugin versions prior to 3.0.2 Description The issue exists in the shortcode functionality of the plugin via the id parameter in the includes/class-gistpress.php file. This allows an attacker with the WordPress Contributor role to...
Cross-Site Scripting
Overview All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers bei...
Design/Logic Flaw
Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via an SVG image and HTML file that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser...
CVE-2019-18667
/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...
CVE-2019-5458
Cross-site scripting XSS vulnerability in http-file-server all versions allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser...
PT-2019-2914
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 76.0.3809.87 Description The issue is related to insufficient filtering in URI schemes, allowing a remote attacker to bypass navigation restrictions. This could potentially enable the execution of arbitrary...
Cross-Site Scripting
Overview Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting XSS. The package insufficiently sanitizes user input when creating links, and concatenates the user input in an tag. This allows attackers to create malicious links with JSON payloads such as: "foo":...
PT-2019-2815
Name of the Vulnerable Software and Affected Versions Palo Alto Networks MineMeld versions 0.9.60 and earlier Description The issue exists due to insufficient protection of the web page structure. It may allow a remote attacker to execute arbitrary JavaScript code in the admin's browser if they c...
PT-2019-20038
Name of the Vulnerable Software and Affected Versions ids-enterprise versions prior to 4.18.2 Description The issue affects the soho-autocomplete component where script tags are not properly encoded, potentially allowing attackers to execute arbitrary JavaScript through Cross-Site Scripting XSS...
CVE-2019-9673
Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...
CVE-2019-9673
Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...
CVE-2019-9673
Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...
CVE-2019-9673: Undefined Security Weakness
Freenet 1483 has a MIME type bypass that allows arbitrary JavaScript execution via a crafted Freenet URI...
PT-2019-2503
Name of the Vulnerable Software and Affected Versions БАРС.ЖКХ-Жилищный Фонд affected versions not specified Description The issue is related to insufficient protection of the web page structure in the БАРС.ЖКХ-Жилищный Фонд platform. An attacker can exploit this issue by using a specially crafte...
CVE-2019-10905
Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...
PT-2019-12083
Name of the Vulnerable Software and Affected Versions Parsedown versions prior to 1.7.2 Description The issue allows attackers to execute arbitrary JavaScript code if a script, already running on the affected page, executes the contents of any element with a specific class. This occurs because...
CVE-2019-10646
Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...
Pelco cameras Web Interface XSS
The vulnerability of the web interfaces of Pelco Sarix Enhanced and Spectra Enhanced microprogramming systems lies in the insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code in the user’s browser...
Cross site scripting
An cross-site scripting vulnerability exists in Jenkins Config File Provider Plugin 3.4.1 and earlier in src/main/resources/lib/configfiles/configfiles.jelly that allows attackers with permission to define shared configuration files to execute arbitrary JavaScript when a user attempts to delete t...