CVE-2020-3345 Cisco Webex Meetings and Cisco Webex Meetings Server HTML Injection Vulnerability

A vulnerability in certain web pages of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to modify a web page in the context of a browser. The vulnerability is due to improper checks on parameter values within affected pages. An attacker could...

OWOX, Inc.: Unrestricted File Upload in Chat Window

Summary: The application allows the attacker to upload dangerous file types that can be automatically processed within the product's environment. Steps To Reproduce: - Hit the browser and navigate to https://bi.owox.com and sign in. - Open The Chat window. - Upload any .rb or .php file . - Click ...

Wordpress Jannah Theme Stored Cross-Site Scripting Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A stored cross-site scripting vulnerability exists in Wordpress Jannah Theme. An attacker c...

CVE-2020-7692 Improper Authorization

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized...

CVE-2020-7692

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized...

phpList cross-site scripting vulnerability (CNVD-2020-41811)

phpList is an open source newsletter and email marketing software from phpList UK. A cross-site scripting vulnerability exists in phpList 3.5.4 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this...

SolarWinds Serv-U File Server Cross-Site Scripting Vulnerability (CNVD-2020-51523)

SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A cross-site scripting vulnerability exists in SolarWinds Serv-U File Server versions prior to 15.2.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

HCL AppScan Cross-Site Scripting Vulnerability

HCL AppScan is a suite of dynamic analysis testing tools from HCL India, which is primarily used for web security testing. A cross-site scripting vulnerability exists in HCL AppScan Enterprise Edition version 10.0.0 and earlier. The vulnerability stems from the lack of proper validation of...

TYPO3 ke_search extension cross-site scripting vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. kesearch extension is one of the search engine extensions. A cross-site scripting vulnerability exists in TYPO3 kesearch extension. The vulnerability stems from the WEB application lacking...

Victor CMS Cross-Site Scripting Vulnerability (CNVD-2020-61026)

Victor CMS is an open source content management system from Victor Alagwu Software Developers in Nigeria. A cross-site scripting vulnerability exists in Victor CMS 2019-02-28 and prior versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. A...

SolarWinds Serv-U File Server Cross-Site Scripting Vulnerability

SolarWinds Serv-U File Server is a file transfer server from SolarWinds USA. A cross-site scripting vulnerability exists in SolarWinds Serv-U File Server versions prior to 15.2.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can...

Roundcube Webmail Cross-Site Scripting Vulnerability (CNVD-2021-17781)

Roundcube Webmail is an open source browser-based IMAP client that supports address book management, message searching, spell checking and more. A cross-site scripting vulnerability exists in Roundcube Webmail versions prior to 1.2.11, 1.3.x prior to 1.3.14 and 1.4.x prior to 1.4.7. The...

jsPDF cross-site scripting vulnerability

jsPDF is a JavaScript-based PDF document generation library . A cross-site scripting vulnerability exists in all versions of jsPDF. The vulnerability stems from the lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability to execute client-si...

Froala WYSIWYG HTML Editor Cross-Site Scripting Vulnerability

Froala WYSIWYG HTML Editor is a U.S. Froala company's Web-based WYSIWYG rich text editor . A cross-site scripting vulnerability exists in Froala WYSIWYG HTML Editor versions 3.0.6 through 3.1.1. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. A...

WordPress Vanguard Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Vanguard is one of the freelance website theme plugins used in it. A cross-site scripting vulnerability exists in...

Red Hat Keycloak Cross-Site Scripting Vulnerability (CNVD-2021-17784)

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A cross-site scripting vulnerability exists in Red Hat Keycloak. The vulnerability stems from a lack of proper authentication of client-side da...

PrestaShop cross-site scripting vulnerability (CNVD-2020-36217)

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A cross-site scripting vulnerability exists in PrestaShop. The vulnerability stems fr...

TileServer GL Cross-Site Scripting Vulnerability

TileServer GL is an open source map server for vector blocks from the MapTiler team. A cross-site scripting vulnerability exists in the server.js file in TileServer GL 3.0.0 and earlier versions. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. ...

Atlassian JIRA Server and Data Center Cross-Site Scripting Vulnerability (CNVD-2020-53363)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of Atlassian Australia.Atlassian JIRA Server is the server version of a defect tracking management system. Atlassian JIRA Server is the server version of a defect tracking management system that is used to track and manage all...

Atlassian JIRA Server and Data Center Cross-Site Scripting Vulnerability (CNVD-2021-36601)

Atlassian JIRA Server and Atlassian JIRA Data Center are both products of the Australian company Atlassian Atlassian.Atlassian JIRA Server is a server version of a defect tracking management system. The system is mainly used to track and manage all kinds of issues and defects in the...