PT-2020-7774

Name of the Vulnerable Software and Affected Versions: Freebox OS Web interface version 3.0.2 Description: A Cross-Site Scripting XSS issue exists in the description field of a Download RSS item or Contacts, allowing malicious users to execute arbitrary code. Recommendations: For Freebox OS Web...

CVE-2019-16562: Improper Neutralization of Input During Web Page Generation

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions...

CVE-2019-0335: Improper Neutralization of Input During Web Page Generation

Under certain conditions SAP BusinessObjects Business Intelligence Platform Central Management Console, versions 4.1, 4.2, 4.3, allows an attacker to store a malicious payload within the description field of a user account. The payload is triggered when the mouse cursor is moved over the...

PT-2019-11230

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Central Management Console versions 4.1, 4.2, 4.3 Description: The issue allows an attacker to store a malicious payload within the description field of a user account. This payload is...

Firefly III Cross-Site Scripting Vulnerability (CNVD-2019-30449)

Firefly III is a free, open source, self-hosted personal finance manager. A stored cross-site scripting vulnerability exists in Firefly III 4.7.17.4. The vulnerability stems from a lack of filtering of user-supplied data in the transaction description field and the asset account name field. An...

CVE-2019-14668

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link...

CVE-2019-14668: Improper Neutralization of Input During Web Page Generation

Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link...

CVE-2019-14298

Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Descriptionconfig field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx...

CVE-2019-12774

A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044update05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects, for example, the Profile Description...

CVE-2019-12347: Improper Neutralization of Input During Web Page Generation

In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acmeaccountkeysedit.php action. The vulnerability occurs due to input validation errors...

The vulnerability of the Etlas electronic document management system allows a perpetrator to execute arbitrary codes.

The vulnerability of the Etlas e-mail processing system exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the user’s browser by placing it in the “Description” field when creating ...

PT-2019-10206

Name of the Vulnerable Software and Affected Versions: MODX Revolution versions prior to v2.7.0-pl Description: The issue allows for XSS attacks via User Settings, such as the Description field. Recommendations: For MODX Revolution versions prior to v2.7.0-pl, update to a version that contains a...

CVE-2018-15875

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the router's admin UPnP page via the description field in an AddPortMapping UPnP SOAP request...

CVE-2018-15875: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability on D-Link DIR-615 routers 20.07 allows attackers to inject JavaScript into the router's admin UPnP page via the description field in an AddPortMapping UPnP SOAP request...

PT-2018-13261

Name of the Vulnerable Software and Affected Versions D-Link DIR-615 routers version 20.07 Description A cross-site scripting XSS issue allows attackers to inject JavaScript into the router's admin UPnP page via the description field in an "AddPortMapping" UPnP SOAP request. Recommendations For...

CVE-2018-12355: Improper Neutralization of Input During Web Page Generation

Knowage formerly SpagoBI 6.1.1 allows XSS via the name or description field to the "Olap Schemas' Catalogue" catalogue...

CVE-2018-10326

PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the 1 department field in the printer configuration, 2 description field in the print server configuration, and 3 username field for authentication to print as guest...

Cross site scripting

PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the 1 department field in the printer configuration, 2 description field in the print server configuration, and 3 username field for authentication to print as guest...

CVE-2018-10326: Improper Neutralization of Input During Web Page Generation

PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the 1 department field in the printer configuration, 2 description field in the print server configuration, and 3 username field for authentication to print as guest...

PT-2018-9830

Name of the Vulnerable Software and Affected Versions: PrinterOn Enterprise version 4.1.3 Description: The issue concerns multiple authenticated stored XSS vulnerabilities. These vulnerabilities can be exploited via the department field in the printer configuration, the description field in the...