Cross-Site Scripting in node-red

Versions of node-red prior to 0.18.6 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 0.18.6 or later...

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using tags in the method descriptions. Recommendation Upgrade to version 2.2.1 or later...

Cross-Site Scripting in diagram-js-direct-editing

Versions of diagram-js-direct-editing prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser. Recommendation Upgrade to version 1.4.3 or later...

GHSA-8FW4-XH83-3J6Q Cross-Site Scripting in diagram-js

Versions of diagram-js prior to 3.3.1 for 3.x and 2.6.2 for 2.x are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in search-pad, allowing attackers to execute arbitrary JavaScript. Recommendation If you are using diagram-js 3.x, upgrade to version...

CVE-2020-16873: Initialization of a Resource with an Insecure Default

A spoofing vulnerability manifests in Microsoft Xamarin.Forms due to the default settings on Android WebView version prior to 83.0.4103.106. This vulnerability could allow an attacker to execute arbitrary Javascript code on a target system. For the attack to be successful, the targeted user would...

PT-2020-21598

Name of the Vulnerable Software and Affected Versions serve versions prior to 10.0.2 Description The issue allows attackers to execute arbitrary JavaScript in the victim's browser due to the package not encoding output when user-supplied input is rendered. This can lead to Cross-Site Scripting XS...

PT-2020-21243

Name of the Vulnerable Software and Affected Versions serve versions prior to 10.0.2 Description The issue arises from the package's failure to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. This c...

PT-2020-21153

Name of the Vulnerable Software and Affected Versions diagram-js versions prior to 3.3.1 diagram-js versions prior to 2.6.2 Description The issue concerns the failure to escape output of user-controlled input in the search-pad, allowing attackers to execute arbitrary JavaScript, which can lead to...

PT-2020-21061

Name of the Vulnerable Software and Affected Versions node-red versions prior to 0.18.6 Description The issue is related to Cross-Site Scripting XSS due to the failure to sanitize the name field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser...

Cross-Site Scripting (XSS)

webkit2gtk3 is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript on the user's browser by providing malicious web content...

CVE-2020-2036 PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface

A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...

PAN-OS: Reflected Cross-Site Scripting (XSS) vulnerability in management web interface

A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...

CVE-2020-6326

SAP NetWeaver Knowledge Management, version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting...

PT-2020-3956

Name of the Vulnerable Software and Affected Versions: PAN-OS versions earlier than 8.1.16 PAN-OS versions earlier than 9.0.9 Description: A reflected cross-site scripting XSS issue exists in the PAN-OS management web interface. This could allow a remote attacker to execute arbitrary JavaScript...

Adobe Experience Manager (AEM) stored cross-site scripting vulnerability (CNVD-2020-52153)

Adobe Experience Manager is an enterprise content management solution that helps you streamline the management and delivery of your content and assets. A stored cross-site scripting vulnerability exists in Adobe Experience Manager AEM. An attacker can exploit this vulnerability to execute arbitra...

CVE-2020-6326: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Knowledge Management, version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting...

CVE-2020-2036: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in the PAN-OS management web interface. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could...

Adobe Experience Manager (AEM) Cross-Site Scripting Vulnerability (CNVD-2020-51768)

Adobe Experience Manager is an enterprise content management solution that helps you streamline the management and delivery of your content and assets. A stored cross-site scripting vulnerability exists in Adobe Experience Manager AEM. An attacker can exploit this vulnerability to execute arbitra...

PT-2020-5112

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions prior to 6.5.5.0 Adobe Experience Manager versions prior to 6.4.8.1 Description The issue is related to an AEM java servlet that executes with the permissions of a high privileged service user, potentially...

PT-2020-5100

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager AEM Forms add-on versions 6.5.5.0 and below Adobe Experience Manager AEM Forms add-on versions 6.4.8.1 and below Description The issue is related to a stored XSS vulnerability that allows users with 'Author' privileges...