18316 matches found
CVE-2019-8450: Improper Neutralization of Input During Web Page Generation
Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of a custom...
Cross site scripting
A stored cross-site scripting XSS vulnerability was found in Limesurvey before 3.17.14 that allows authenticated users with correct permissions to inject arbitrary web script or HTML via titles of admin box buttons on the home page...
Cross site scripting
A reflected cross-site scripting XSS vulnerability was found in Limesurvey before 3.17.14 that allows remote attackers to inject arbitrary web script or HTML via extensions of uploaded files...
CVE-2019-16178
LimeSurvey prior to 3.17.14 is affected by a stored XSS vulnerability that allows authenticated users with appropriate permissions to inject arbitrary script or HTML via the titles of admin box buttons on the home page. Root cause is input in button titles not properly sanitized before rendering....
CVE-2019-15944
CVE-2019-15944 affects Counter-Strike: Global Offensive, specifically community game servers, with the issue described as displaying unsafe HTML in a disconnection message prior to 2019-08-29. Supported documents confirm the target is CS:GO game servers and the vulnerability arises from unsafe HT...
CVE-2019-15944: Improper Encoding or Escaping of Output
In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection message...
iswgoa3z.sportsretriever.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-955962 Security Researcher geeknik Helped patch 8722 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting iswgoa3z.sportsretriever.co...
CVE-2019-13975
eGain Chat 15.0.3 allows HTML Injection...
CVE-2019-13975
eGain Chat 15.0.3 allows HTML Injection...
Design/Logic Flaw
eGain Chat 15.0.3 allows HTML Injection...
CVE-2019-13975
eGain Chat 15.0.3 allows HTML Injection...
CVE-2019-13975
CVE-2019-13975 : The supplied connected documents identify an HTML Injection vulnerability in eGain Chat 15.0.3 . The CVSS details indicate a network-accessible issue with low to moderate impact: base CVSS v3.0 score 6.1 (vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with no availability...
CVE-2019-15814
Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML...
CVE-2019-15814: Improper Neutralization of Input During Web Page Generation
Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML...
GitLab HTML Injection Vulnerability (CNVD-2019-31316)
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An HTML injection vulnerability exists in GitLab Enterpri...
Nextcloud: XSS in desktop client via invalid server address on login form
Team! I have found this vulnerability that in my time would be called "cross zone" but at the moment I don't know. The problem is found in the latest version of "nextcloud.exe" for your windows version. The problem occurs with the initial screen where you ask to connect to a website. Apparently...
FreeBSD : Gitlab -- Multiple Vulnerabilities (b68cc195-cae7-11e9-86e9-001b217b3468)
Gitlab reports : Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure Use...
Gitlab -- Multiple Vulnerabilities
Gitlab reports: Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure User...
CVE-2018-15512: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML...