4333 matches found
PT-2018-14349
Name of the Vulnerable Software and Affected Versions IBM Security Guardium versions 10 and 10.5 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...
PT-2018-14757
Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0.5, 6.1.1, 6.2.0, 7.0.1, 7.0.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...
CVE-2018-12311: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in File Explorer in ASUSTOR ADM version 3.1.1 allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename...
PT-2018-11110
Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1 Description A cross-site scripting issue in File Explorer allows attackers to execute arbitrary JavaScript when a file is moved via a malicious filename. Recommendations For ASUSTOR ADM version 3.1.1, consider renamin...
Cross-Site Scripting (XSS)
Dnn.Platform is vulnerable to cross-site scripting. A lack of sanitization in the redirect URL as displayed on the redirect page allows remote attackers to inject arbitrary Javascript into a victim's browser to steal session cookies or perform unwanted actions on behalf of the user...
PT-2018-14092
Name of the Vulnerable Software and Affected Versions IBM Rational Collaborative Lifecycle Management versions 5.0 through 5.0.2 IBM Rational Collaborative Lifecycle Management versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering...
Design/Logic Flaw
Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...
CVE-2018-12120: Unprotected Primary Channel
Node.js: All versions prior to Node.js 6.15.0: Debugger port 5858 listens on any interface by default: When the debugger is enabled with node --debug or node debug, it listens to port 5858 on all interfaces by default. This may allow remote computers to attach to the debug port and evaluate...
Xiaomi Mi Router 3 Cross-Site Scripting Vulnerability
Xiaomi Mi Router 3 is a wireless router product from Chinese company Xiaomi. A cross-site scripting vulnerability exists in the API 404 page in Xiaomi Mi Router 3 version 2.22.15. A remote attacker can exploit this vulnerability to execute arbitrary JavaScript code via a modified URL path...
Cross site scripting
Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path...
CVE-2018-13022
Cross-site scripting vulnerability in the API 404 page on Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary JavaScript via a modified URL path...
Cross site scripting
Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field...
Cross site scripting
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...
CVE-2018-13308
Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "User phrases button" field...
CVE-2018-13309
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's password...
CVE-2018-13312
Cross-site scripting in noticegen.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript by modifying the "Input your notice URL" field...
CVE-2018-13310
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...
Cross site scripting
Cross-site scripting in password.htm in TOTOLINK A3002RU version 1.0.8 allows attackers to execute arbitrary JavaScript via the user's username...
