CVE-2020-24983

An issue was discovered in Quadbase EspressReports ES 7 Update 9. An unauthenticated attacker can create a malicious HTML file that houses a POST request made to the DashboardBuilder within the target web application. This request will utilise the target admin session and perform the authenticate...

Quadbase EspressReports ES Cross-site Request Forgery Vulnerability

Quadbase EspressReports ES is a software application from Quadbase, Inc. It provides special reporting and querying capabilities that allow users to create various queries and reports through a zero-client browser interface. A cross-site request forgery vulnerability exists in Quadbase...

PDF Viewer Code Execution

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2015 are related to data type conversion errors. Exploiting these vulnerabilities can allow an attack...

CVE-2020-14166: Improper Neutralization of Input During Web Page Generation

The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting XSS vulnerability by uploading a html file...

PT-2020-13905

Name of the Vulnerable Software and Affected Versions Jira Service Desk Server and Data Center versions prior to 4.10.0 Description The issue allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript via a Cross Site Scripting XSS vulnerability by...

Google Chrome Privilege Escalation

The vulnerability of Google Chrome relates to the improper assignment of access rights for a critical resource. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information and compromise its integrity and accessibility through a specially created HTML fil...

Google Chrome Heap Buffer Overflow

The vulnerability of Google Chrome relates to the writing beyond the buffer of the memory buffer. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and compromise its integrity and availability through a specially created HTML file...

Google Chrome Memory Leak Unauthorized Access

The vulnerability of Google Chrome relates to the use of memory after deallocation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information and compromise its integrity and availability through a specially created HTML file...

Denial Of Service (DoS)

elinks is vulnerable to denial of service DoS. The vulnerability exists as a off-by-one buffer overflow flaw was discovered in the way ELinks handled its internal cache of string representations for HTML special entities. A remote attacker could use this flaw to create a specially-crafted HTML fi...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

Cross site scripting

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10114

CVE-2020-10114 affects cPanel prior to 84.0.20. The vulnerability is described as a stored self‑XSS via the HTML file editor (SEC-535). The connected documents do not provide additional technical details such as affected components beyond the editor, exploit vectors, or concrete remediation steps...

CVE-2020-10114: Improper Neutralization of Input During Web Page Generation

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

PT-2020-11936

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 84.0.20 Description The issue allows stored self-XSS via the HTML file editor. Recommendations For versions prior to 84.0.20, update to version 84.0.20 or later to resolve the issue...

Mail.ru: xss in ub.icq.net

XSS in ub.icq.net via HTML file upload. icq.net is a sandbox API domain without cookies or HTTP authentication...

CVE-2019-15614

Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files...

Xerox AltaLink C8035 Printer - Cross-Site Request Forgery (Add Admin)

Exploit Title: Xerox AltaLink C8035 Printer - Cross-Site Request Forgery Add Admin Date: 2018-12-17 Exploit Author: Ismail Tasdelen Vendor Homepage: https://www.xerox.com/ Hardware Link : https://www.office.xerox.com/en-us/multifunction-printers/altalink-c8000-series Software : Xerox Printer...

Design/Logic Flaw

SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951 to achieve remote code execution via a .html file, containing short codes, that is served over HTTP...