PT-2020-5066

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and earlier Adobe Experience Manager versions 6.4.8.1 and earlier Adobe Experience Manager versions 6.3.3.8 and earlier Description The issue is related to insufficient protection of the web page...

PT-2020-5113

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and earlier Adobe Experience Manager versions 6.4.8.1 and earlier Adobe Experience Manager versions 6.3.3.8 and earlier Adobe Experience Manager versions 6.2 SP1-CFP20 and earlier Description The issue...

PT-2020-5101

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and earlier Adobe Experience Manager versions 6.4.8.1 and earlier Adobe Experience Manager versions 6.3.3.8 and earlier Adobe Experience Manager versions 6.2 SP1-CFP20 and earlier Description The issue...

PT-2020-5124

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and below Adobe Experience Manager versions 6.4.8.1 and below Adobe Experience Manager versions 6.3.3.8 and below Adobe Experience Manager versions 6.2 SP1-CFP20 and below Description The issue is...

PT-2020-5050

Name of the Vulnerable Software and Affected Versions Adobe Experience Manager versions 6.5.5.0 and earlier Adobe Experience Manager versions 6.4.8.1 and earlier Adobe Experience Manager versions 6.3.3.8 and earlier Adobe Experience Manager versions 6.2 SP1-CFP20 and earlier Description The issue...

GHSA-5FF8-JCF9-FW62 Cross-Site Scripting in markdown-it-katex

All versions of markdown-it-katex are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error. Recommendation No fix is currently available. Consider using a...

Cross-Site Scripting in atlasboard-atlassian-package

All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able t...

Cross-Site Scripting in nextcloud-vue-collections

Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code i...

PT-2020-21559

Name of the Vulnerable Software and Affected Versions nextcloud-vue-collections versions prior to 0.4.2 Description The issue concerns an insecure configuration in the v-tooltip component, which allows arbitrary JavaScript to be injected into the tooltip of a collection item. This enables attacke...

PT-2020-20949

Name of the Vulnerable Software and Affected Versions atlasboard-atlassian-package versions prior to 0.4.2 Description The issue arises from the package's failure to properly sanitize user input that is rendered as HTML, potentially allowing attackers to execute arbitrary JavaScript in a victim's...

GHSA-VPJ4-89Q8-RH38 Cross-Site Scripting in bpmn-js-properties-panel

Versions of bpmn-js-properties-panel prior to 0.31.0 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website. Recommendation Upgrade to version 0.31.0 or lat...

GHSA-V9WP-8R97-V6XG Cross-Site Scripting in jquery.json-viewer

Versions of jquery.json-viewer prior to 1.3.0 are vulnerable to Cross-Site Scripting XSS. The package insufficiently sanitizes user input when creating links, and concatenates the user input in an tag. This allows attackers to create malicious links with JSON payloads such as: "foo":...

GHSA-C53X-WWX2-PG96 Cross-Site Scripting in @berslucas/liljs

Versions of @berslucas/liljs prior to 1.0.2 are vulnerable to Cross-Site Scripting XSS. The package uses the unsafe innerHTML function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation Upgrade to version 1.0.2 or later...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

Cross site scripting

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

CVE-2020-12058

Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/orderstatus.php, catalog/admin/taxrates.php, catalog/admin/languages.php,...

PT-2020-21476

Name of the Vulnerable Software and Affected Versions eco versions all Description The issue concerns Cross-Site Scripting XSS due to the package's default escape implementation failing to properly escape single quotes. This failure may allow attackers to execute arbitrary JavaScript on the...

PT-2020-21348

Name of the Vulnerable Software and Affected Versions snekserve versions all Description The issue arises from the failure to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. This is a Cross-Site...

PT-2020-21528

Name of the Vulnerable Software and Affected Versions bpmn-js-properties-panel versions prior to 0.31.0 Description The issue is related to Cross-Site Scripting XSS due to the failure to sanitize input in specially configured diagrams. This may allow attackers to inject arbitrary JavaScript in th...

PT-2020-21409

Name of the Vulnerable Software and Affected Versions dompurify versions prior to 2.0.7 Description The issue allows an attacker to bypass the package sanitization through Mutation XSS, potentially enabling the execution of arbitrary JavaScript in a victim's browser. Recommendations Upgrade to...