474 matches found
CVE-2020-26701: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter...
PT-2020-16485
Name of the Vulnerable Software and Affected Versions Kaa IoT Platform version 1.2.0 Description The issue allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter in the Dashboards section. This enables attackers to execute arbitrary code o...
CVE-2020-9299
There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description parameters of Incident Priority, Incident Type, Tag Type, and Incident Filter. This vulnerability can be exploited by an authenticated user...
PT-2020-20574
Name of the Vulnerable Software and Affected Versions Dispatch affected versions not specified Description The Dispatch application has a security issue where an authenticated user can exploit XSS vulnerabilities. These vulnerabilities affect the name and description parameters of Incident...
CVE-2018-8062
A cross-site scripting XSS vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04R02.A2pD035g.d23i firmware allows remote attackers to inject arbitrary web script or HTML via the Service Description parameter while creating a WAN service...
CVE-2020-25131
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting XSS due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the rolename or roledescr parameter to the roles/ URI...
CVE-2020-25102
silverstripe-advancedreports aka the Advanced Reports module for SilverStripe 1.0 through 2.0 is vulnerable to Cross-Site Scripting XSS because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item ak...
PT-2020-15945
Name of the Vulnerable Software and Affected Versions silverstripe-advancedreports versions 1.0 through 2.0 Description The issue allows for Cross-Site Scripting XSS due to the possibility of injecting and storing malicious JavaScript code. This affects the "report preview" when an SVG document i...
CVE-2020-25102: Improper Neutralization of Input During Web Page Generation
silverstripe-advancedreports aka the Advanced Reports module for SilverStripe 1.0 through 2.0 is vulnerable to Cross-Site Scripting XSS because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item ak...
PT-2020-10172
Name of the Vulnerable Software and Affected Versions Matrix42 Workspace Management versions 9.1.2.2765 and below Description The issue allows stored XSS via unfiltered description parameters, as demonstrated by the comment field of a special order for individual software. This can be exploited...
CVE-2019-17651: Improper Neutralization of Input During Web Page Generation
An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack XSS by injecting malicious JavaScript code into...
CVE-2020-7106
Cacti 1.2.8 has stored XSS in datasources.php, colortemplatesitem.php, graphs.php, graphitems.php, lib/apiautomation.php, useradmin.php, and usergroupadmin.php, as demonstrated by the description parameter in datasources.php a raw string from the database that is displayed by $header to trigger t...
CVE-2020-7106
Cacti 1.2.8 has stored XSS in datasources.php, colortemplatesitem.php, graphs.php, graphitems.php, lib/apiautomation.php, useradmin.php, and usergroupadmin.php, as demonstrated by the description parameter in datasources.php a raw string from the database that is displayed by $header to trigger t...
CVE-2020-7106
Cacti 1.2.8 has stored XSS in datasources.php, colortemplatesitem.php, graphs.php, graphitems.php, lib/apiautomation.php, useradmin.php, and usergroupadmin.php, as demonstrated by the description parameter in datasources.php a raw string from the database that is displayed by $header to trigger t...
CVE-2020-7106
Cacti 1.2.8 has stored XSS in datasources.php, colortemplatesitem.php, graphs.php, graphitems.php, lib/apiautomation.php, useradmin.php, and usergroupadmin.php, as demonstrated by the description parameter in datasources.php a raw string from the database that is displayed by $header to trigger t...
CVE-2020-7106: Improper Neutralization of Input During Web Page Generation
Cacti 1.2.8 has stored XSS in datasources.php, colortemplatesitem.php, graphs.php, graphitems.php, lib/apiautomation.php, useradmin.php, and usergroupadmin.php, as demonstrated by the description parameter in datasources.php a raw string from the database that is displayed by $header to trigger t...
CVE-2019-8422
A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php...
PT-2019-19024
Name of the Vulnerable Software and Affected Versions PbootCMS version 1.3.2 Description A SQL Injection issue exists via the description parameter in the ContentController.php file. Recommendations For PbootCMS version 1.3.2, consider restricting access to the description parameter in the...
CVE-2019-8422: Improper Neutralization of Special Elements used in an SQL Command
A SQL Injection vulnerability exists in PbootCMS v1.3.2 via the description parameter in apps\admin\controller\content\ContentController.php...
razorCMS Cross-Site Scripting Vulnerability (CNVD-2019-00810)
razorCMS is an open source content management system written in PHP, which stores all data in flat files, so there is no need to install a database. A cross-site scripting vulnerability exists in razorCMS version 3.4.8. A remote attacker can exploit this vulnerability by injecting HTML or script...