PT-2020-21047

Name of the Vulnerable Software and Affected Versions bleach versions affected versions not specified Description The issue allows attackers to bypass the package's HTML sanitization, potentially leading to Cross-Site Scripting XSS attacks. This can be achieved with specific payloads, such as...

PT-2020-21024

Name of the Vulnerable Software and Affected Versions takeapeek versions all versions Description The issue concerns a failure to sanitize filenames, which allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. This is a...

PT-2020-13020

Name of the Vulnerable Software and Affected Versions osCommerce CE Phoenix versions prior to 1.0.6.0 Description The issue allows an attacker to inject and execute arbitrary JavaScript code. This can be achieved by injecting malicious code into specific parameters, including the page parameter t...

PT-2020-21246

Name of the Vulnerable Software and Affected Versions @toast-ui/editor versions prior to 2.2.0 Description The issue allows attackers to execute arbitrary JavaScript on a victim's browser due to multiple bypasses of the package's built-in XSS sanitization, which may lead to Cross-Site Scripting...

PT-2020-21477

Name of the Vulnerable Software and Affected Versions @ionic/core versions prior to 4.0.3 @ionic/core versions prior to 4.1.3 @ionic/core versions prior to 4.2.1 @ionic/core versions prior to 4.3.1 Description The issue affects @ionic/core, where the package uses the unsafe innerHTML function...

PT-2020-21514

Name of the Vulnerable Software and Affected Versions jquery.json-viewer versions prior to 1.3.0 Description The issue arises from insufficient sanitization of user input when creating links, allowing attackers to create malicious links with JSON payloads. This can lead to arbitrary JavaScript...

GHSA-3QH4-R86R-GRVM Arbitrary JavaScript Execution in typed-function

Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code. Recommendation Upgrade to version 0.10.6 or later...

Cross-Site Scripting in express-cart

All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is currently...

GHSA-9PR3-7449-977R Cross-Site Scripting in express-cart

All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is currently...

PT-2020-21129

Name of the Vulnerable Software and Affected Versions ag-grid-community versions prior to 14.0.0 Description The issue arises from improper sanitization of grid contents, which may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. This can lead to Cross-Site...

PT-2020-21256

Name of the Vulnerable Software and Affected Versions harp versions all Description The issue concerns a Cross-Site Scripting vulnerability due to the misconfiguration of the rendering engine in harp, which fails to sanitize HTML output. This allows attackers to run arbitrary JavaScript when...

PT-2020-21202

Name of the Vulnerable Software and Affected Versions harp versions affected versions not specified Description The issue allows for Cross-Site Scripting, where an attacker can inject arbitrary JavaScript as a new product option in the admin page, enabling the execution of arbitrary code. This...

Cross-Site Scripting in highcharts

Versions of highcharts prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize href values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link...

PT-2020-21318

Name of the Vulnerable Software and Affected Versions highcharts versions prior to 7.2.2 highcharts versions prior to 8.1.1 Description The issue arises from the failure to sanitize href values and the lack of restriction on URL schemes, allowing attackers to execute arbitrary JavaScript in a...

WP Customer Reviews < 3.4.3 - Multiple Unauthenticated and Low Priv Authenticated Stored XSS

Multiple stored cross-site scripting vulnerabilities in WP Customer Reviews 3.4.2 and lower allow remote attackers to inject arbitrary JavaScript code or HTML. PoC If WP Customer Reviews is enabled on a page, an unauthenticated attacker can exploit XSS via review form's parameters: - Reviewer Nam...

Cross-Site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser when the library is configured in classic editing mode. The stripping and sanitization logic of TinyMCE can be bypassed using nested and non-terminated HTML tags,...

Cross-Site Scripting (XSS)

prismjs is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript via the easing preview of the Previewers plugin...

PT-2020-13186

Name of the Vulnerable Software and Affected Versions TinyMCE versions 4.9.10 and earlier TinyMCE versions 5.2.1 and earlier TinyMCE versions 5.4.0 and earlier Description A cross-site scripting XSS vulnerability allows remote attackers to inject arbitrary web script when configured in classic...

CVE-2020-4539

IBM Jazz Reporting Service 6.0.2, 6.0.6, 6.0.6.1, 7.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Cross-Site Scripting (XSS)

Jenkins is vulnerable to cross-site scripting. The agent name in the build time trend page is not validated, allowing an attacker to inject and execute arbitrary Javascript in a user's browser...