CVE-2020-6845

TopManage OLK 2020 is affected by a DOM-based XSS issue caused by not setting ReadOnly on the session cookie, enabling takeover of user and admin accounts. Multiple sources (NVD, Red Hat, CNVD, etc.) corroborate the vulnerability in TopManage OLK 2020. The provided documents describe the root cau...

CVE-2020-6845: Improper Neutralization of Input During Web Page Generation

An issue was discovered in TopManage OLK 2020. As there is no ReadOnly on the Session cookie, the user and admin accounts can be taken over in a DOM-Based XSS attack...

PT-2020-19260

Name of the Vulnerable Software and Affected Versions TopManage OLK version 2020 Description The issue allows for a DOM-Based XSS attack, enabling the takeover of user and admin accounts due to the lack of ReadOnly protection on the Session cookie. Recommendations For TopManage OLK version 2020,...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

Design/Logic Flaw

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

CVE-2020-7050

Codoforum (Codologic) up to version 4.8.4 is affected by a DOM-based XSS vulnerability. The issue arises when a normal user creates a new topic and adds a poll, which is then automatically loaded in the DOM when the thread is opened. The description notes that session cookies lack the HttpOnly fl...

CVE-2020-7050

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

CVE-2020-7050: Improper Neutralization of Input During Web Page Generation

Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user, it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag, it is possible to steal authentication cooki...

PT-2020-19358

Name of the Vulnerable Software and Affected Versions Codologic Codoforum versions 4.8.4 and earlier Description The issue allows for a DOM-based XSS attack. When creating a new topic, a user can add a poll that is automatically loaded into the DOM when the thread or topic is opened. Since sessio...

@bloomreach/hippo-theme (2.2.3), @covisint/cui-idm-b2x (>=0.2.1, <=1.3.0) +369 more potentially affected by CVE-2019-14863 via angular (>=1.0.8, <=1.4.14)

angular NPM version =1.0.8, =0.2.1, =0.2.0-dev, =1.2.6, =0.3.2, =1.0.4, =0.1.1, =1.0.4, =1.1.24, =1.0.3, =1.0.12, =1.0.7, =0.0.1, =3.2.10-0, =3.2.10-1 and more Source cves: CVE-2019-14863 Source advisory: OSV:GHSA-R5FX-8R73-V86C...

PT-2020-10231

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions prior to 2.6.6 Description The issue is a Document Object Model DOM based cross-site scripting vulnerability. It could allow JavaScript code to be executed in the user's web browser if a specially crafted...

Razer: DOM-based XSS on https://zest.co.th/zestlinepay/

The tester discovered a DOM based XSS on a Razer Gold Thailand associated website that could allow stealing of user session cookies. He provided excellent reproduction steps and a video PoC. Razer thanks the tester for his great report and helping us to keep our customers' information secure...

CVE-2020-7239

The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...

CVE-2020-7239

The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...

CVE-2020-7239

The CVE-2020-7239 entry concerns the WordPress plugin conversation-watson (before 0.8.21). The vulnerability is a DOM-based XSS that is triggered when a chat message containing JavaScript is sent, indicating an input/output filtering weakness in the plugin's handling of client-side data. The Red ...

CVE-2020-7239: Improper Neutralization of Input During Web Page Generation

The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent...

PT-2020-19489

Name of the Vulnerable Software and Affected Versions conversation-watson plugin versions prior to 0.8.21 Description The issue is a DOM-based XSS vulnerability. It occurs when a chat message containing JavaScript is sent. This allows for the execution of malicious scripts within the context of t...

CVE-2020-6847

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

CVE-2020-6847

OpenTrade up to version 0.2.0 contains a DOM-based XSS vulnerability that is triggered when an administrator attempts to delete a message that contains JavaScript. The root cause is related to client-side data handling in the web application, leading to potential injection of script during the de...