CVE-2019-10634

An XSS vulnerability in the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to inject arbitrary JavaScript or HTML via the user, group, and file-share description fields...

PT-2019-2095

Name of the Vulnerable Software and Affected Versions Региональный электронный бюджет affected versions not specified Description The issue is related to insufficient protection of the web page structure in the integration platform, allowing a remote attacker to execute arbitrary JavaScript code ...

CVE-2019-1567: Improper Neutralization of Input During Web Page Generation

The Expedition Migration tool 1.1.6 and earlier may allow an authenticated attacker to run arbitrary JavaScript or HTML in the User Mapping Settings...

Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using a...

PT-2019-12132

Name of the Vulnerable Software and Affected Versions Materialize versions prior to 1.0.1 materialize-css all versions Description The issue allows for Cross-Site Scripting XSS due to insufficient sanitization of user input in the tooltip component. This enables an attacker to execute arbitrary...

SuiteCRM 7.x <= 7.8.23 and 7.10.x <= 7.10.10 XSS Vulnerability

SuiteCRM is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-10905

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

CVE-2019-10905

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

CVE-2019-10905

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

PT-2019-12083

Name of the Vulnerable Software and Affected Versions Parsedown versions prior to 1.7.2 Description The issue allows attackers to execute arbitrary JavaScript code if a script, already running on the affected page, executes the contents of any element with a specific class. This occurs because...

The vulnerability of Google Chrome’s browser, related to improper input validation, allows a malicious actor to execute JavaScript code from an arbitrary source.

The vulnerability of Google Chrome relates to errors in handling redirects for URLs that are not allowed. Exploiting this vulnerability allows a malicious actor to execute JavaScript code from an arbitrary source, using a specially created HTML page...

CVE-2018-1731

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1913

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2019-17655

Name of the Vulnerable Software and Affected Versions buttle version 0.2.0 buttle versions prior to a fixed version no fixed version specified Description The issue allows execution of attacker-provided code in the victim's browser. This occurs when an attacker creates an arbitrary file on the...

Cross site scripting

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...

CVE-2019-10646

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...

CVE-2019-10646: Improper Neutralization of Input During Web Page Generation

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...

CVE-2019-1003042

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin...

Cross-Site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting XSS. User input are not escaped before being displayed on a user's browser, allowing remote attackers to inject arbitrary Javascript into a victim's browser via logmeta values and user's last name in the API...

CVE-2019-1003042: Improper Neutralization of Input During Web Page Generation

A cross site scripting vulnerability in Jenkins Lockable Resources Plugin 2.4 and earlier allows attackers able to control resource names to inject arbitrary JavaScript in web pages rendered by the plugin...