Cisco Identity Services Engine XSS (cisco-sa-ise-xxs-mf5cbYx5)

A cross-site scripting XSS vulnerability exists in Cisco Identity Services Engine web-based management interface due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, by convincing a user to click a specially crafted UR...

Kentico CMS < 12.0.50 XSS

According to its self-reported version number, the version of Kentico CMS on the remote host is prior to 12.0.50. It is, therefore, affected by a cross-site scripting XSS vulnerability due to the Content-Type header being inconsistent with the file extension. An unauthenticated, remote attacker c...

CVE-2020-8348

A DOM-based cross-site scripting XSS vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's current browser session if a crafted url is visited, possibly through phishing...

Cross site scripting

A DOM-based cross-site scripting XSS vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's current browser session if a crafted url is visited, possibly through phishing...

CVE-2020-15774

An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle Enterprise and since closed their browser could reopen their browser to access Gradle Enterprise as that user...

CVE-2020-6288

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface allows an attacker with edit document rights to upload any file including script files without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker c...

Design/Logic Flaw

SAP Business Objects Business Intelligence Platform Web Intelligence HTML interface allows an attacker with edit document rights to upload any file including script files without proper file format validation leading to Unrestricted upload of file with dangerous type vulnerability. The attacker c...

CVE-2020-5774

Nessus versions 8.11.0 and earlier were found to maintain sessions longer than the permitted period in certain scenarios. The lack of proper session expiration could allow attackers with local access to login into an existing browser session...

Atlassian Jira 7.13.x < 8.3.0 XSS (JRASERVER-70856)

According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is 7.13.x prior to 8.3.0. It is, therefore, affected by a cross-site scripting XSS vulnerability in the project configuration feature due to improper validation of user-supplied input...

SharePoint Open Redirect Vulnerability

An open redirect vulnerability exists in Microsoft SharePoint that could lead to spoofing. To exploit the vulnerability, an attacker could send a link that has a specially crafted URL and convince the user to click the link. When an authenticated SharePoint user clicks the link, the authenticated...

keycloak: session hijack using the user access token

Keycloak up to version 6.0.0 allows the end user token access or id token JWT to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session...

Atlassian JIRA 6.0 < 8.5.5 / 8.6 < 8.8.1 XSS (JRASERVER-70923)

According to its self-reported version number, the instance of Atlassian JIRA hosted on the remote web server is 6.x prior to 8.5.5 or 8.6.x prior to 8.8.1. It is, therefore, affected by a cross-site scripting XSS vulnerability in its view issue screen due to improper validation of user-supplied...

WordPress 3.8.x < 3.8.33 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

WordPress 5.3.x < 5.3.3 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

WordPress 5.2.x < 5.2.6 Multiple Vulnerabilities

According to its self-reported version number, the detected WordPress application is affected by multiple vulnerabilities : - Six cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An remote attacker can exploit these, by convincing a user to click a...

IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.15 / 9.x < 9.0.0.10 XSS (CVE-2018-1794)

The IBM WebSphere Application Server running on the remote host is version 7.0.0.0 through 7.0.0.45, 8.0.0.0 through 8.0.0.15, 8.5.x prior to 8.5.5.15, or 9.x prior to 9.0.0.10. It is, therefore, affected by a cross-site scripting XSS vulnerability in the OAuth ear due to improper validation of...

Input validation

Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue...

Cross-site Scripting (XSS)

jboss is vulnerable to cross-site scripting XSS. The vulnerability exists as an attacker could use these flaws to present misleading data to an authenticated user, or execute arbitrary scripting code in the context of the authenticated user's browser session...

Arbitrary Code Execution

jboss is vulnerable to arbitrary code execution. The vulnerability exists through an XSS flaw was found in the JMX Console. An attacker could use this flaw to present misleading data to an authenticated user, or execute arbitrary scripting code in the context of the authenticated user's browser...

ICSA-20-072-01_ABB eSOMS

1. EXECUTIVE SUMMARY CVSS v3 7.6 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: ABB Equipment: eSOMS Vulnerabilities: Use of Web Browser Cache Containing Sensitive Information, Improper Restriction of Rendered UI Layers or Frames, Improper Neutralization of HTTP Headers for...