CVE-2021-29209: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29210: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

CVE-2021-29208: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 iLO 4; HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380...

PT-2021-18127

Name of the Vulnerable Software and Affected Versions: HPE Integrated Lights-Out 4 iLO 4 versions prior to 2.78 HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers versions prior to 2.78 HPE SimpliVity 380 Gen9 versions prior to 2.78 HPE SimpliVity 380 Gen10 versions prior to 2.78 HPE...

PT-2021-18129

Name of the Vulnerable Software and Affected Versions: HPE Integrated Lights-Out 4 iLO 4 versions prior to 2.78 HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers versions prior to 2.78 HPE SimpliVity 380 Gen9 versions prior to 2.78 HPE SimpliVity 380 Gen10 versions prior to 2.78 HPE...

PT-2021-18128

Name of the Vulnerable Software and Affected Versions: HPE Integrated Lights-Out 4 iLO 4 versions prior to 2.78 HPE Integrated Lights-Out 5 iLO 5 for HPE Gen10 Servers versions prior to 2.78 HPE SimpliVity 380 Gen9 versions prior to 2.78 HPE SimpliVity 380 Gen10 versions prior to 2.78 HPE...

GHSA-9FGX-Q25H-JXRG DOM XSS in Theme Preview

Impact An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they'...

CVE-2021-29484 DOM XSS in Theme Preview

Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and m...

Ozon: DOM XSS в learning.ozon.ru

DOM XSS in learning.ozon.ru via return parameter routerback...

CVE-2020-36288: Improper Neutralization of Input During Web Page Generation

The issue navigation and search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting XSS vulnerability caused...

PT-2021-11995

Name of the Vulnerable Software and Affected Versions: Jira Server and Data Center versions 8.5.11 and earlier Jira Server and Data Center versions 8.6.0 through 8.13.3 Jira Server and Data Center versions 8.14.0 through 8.15.0 Description: The issue navigation and search view in Jira Server and...

DOM XSS in the issue navigation & search view via parameter pollution - CVE-2020-36288

The issue navigation & search view in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.1 allows remote attackers to inject arbitrary HTML or JavaScript via a DOM Cross-Site Scripting XSS vulnerability caused b...

CVE-2020-29587

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...

CVE-2020-29587

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...

Design/Logic Flaw

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...

CVE-2020-29587

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...

CVE-2020-29587

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...

CVE-2020-29587

CVE-2020-29587 affects SimplCommerce 1.0.0-rc. The root cause is that the Bootbox.js library used for Bootstrap modal dialogs does not sanitize user input and uses jQuery .html() to append payloads, resulting in a DOM XSS vulnerability. Exploitation details are not provided in the documents, but ...

PT-2021-11694

Name of the Vulnerable Software and Affected Versions: SimplCommerce version 1.0.0-rc Description: The issue arises from the use of the Bootbox.js library in SimplCommerce, which allows for the creation of programmatic dialog boxes using Bootstrap modals. This library does not sanitize user input...

CVE-2020-29587: Improper Neutralization of Input During Web Page Generation

SimplCommerce 1.0.0-rc uses the Bootbox.js library, which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input, which results in a DOM XSS, because it uses the jQuery .html function to directly...