Design/Logic Flaw

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

CVE-2020-7050

Codoforum (Codologic) up to version 4.8.4 is affected by a DOM-based XSS vulnerability. The issue arises when a normal user creates a new topic and adds a poll, which is then automatically loaded in the DOM when the thread is opened. The description notes that session cookies lack the HttpOnly fl...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

Cross site scripting

An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...

CVE-2019-19757

An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...

Razer: DOM-based XSS on https://zest.co.th/zestlinepay/

The tester discovered a DOM based XSS on a Razer Gold Thailand associated website that could allow stealing of user session cookies. He provided excellent reproduction steps and a video PoC. Razer thanks the tester for his great report and helping us to keep our customers' information secure...

CVE-2020-7239

The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...

CVE-2020-7239

The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...

CVE-2020-7239

The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...

CVE-2020-7239

The CVE-2020-7239 entry concerns the WordPress plugin conversation-watson (before 0.8.21). The vulnerability is a DOM-based XSS that is triggered when a chat message containing JavaScript is sent, indicating an input/output filtering weakness in the plugin's handling of client-side data. The Red ...

CVE-2020-6847

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

Cross site scripting

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

CVE-2020-6847

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

CVE-2020-6847

OpenTrade up to version 0.2.0 contains a DOM-based XSS vulnerability that is triggered when an administrator attempts to delete a message that contains JavaScript. The root cause is related to client-side data handling in the web application, leading to potential injection of script during the de...

CVE-2019-18652

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

Design/Logic Flaw

A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...

Cross site scripting

DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Analysis Object Page...

CVE-2019-5989

The CVE-2019-5989 issue is a DOM-based cross-site scripting vulnerability in the Analysis Object Page of Access analysis CGI An-Analyzer (released around 2019-06-24). The root cause is DOM-based XSS that could allow a remote attacker to inject arbitrary web script or HTML via the Analysis Object ...

Razer: dom based xss on [hello.merchant.razer.com]

The tester discovered a DOM based xss on a Razer Merchant Services status server, associated with an unneeded application. Razer Fintech appreciates the tester bringing this to their attention and the clear PoC...

Security Bulletin: Vulnerability affects IBM Watson Assistant for IBM Cloud Pak for Data

Summary DOM-based vulnerability affects IBM Watson TM Assistant for IBM Cloud Pak for Data. A DOM-based, cross-site scripting vulnerability was found in the admin console where user input was not validated correctly. An authenticated user could exploit the flaw by injecting JavaScript code into t...