CVE-2023-4843

Summary (CVE-2023-4843) : Pega Platform versions 7.1–8.8.3 are affected by an HTML Injection issue in the name field used by Visual Business Director. Access to modify this field is restricted to authenticated administrative users. The connected sources corroborate this HTML injection vulnerabili...

Security Bulletin: CVE-2023-24539, CVE-2023-29400, CVE-2023-29403 related to "Go" may affect IBM CICS TX Advanced 11.1

Summary CVE-2023-24539, CVE-2023-29400, CVE-2023-29403 related to "Go" may affect IBM CICS TX Advanced 11.1. IBM CICS TX Advanced has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-24539 DESCRIPTION: Go is vulnerable to HTML injection. A remote attacker could inject malicious...

PT-2023-30848 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 7.1 to 8.8.3 Description: The issue is an HTML Injection problem with a name field used in Visual Business Director. This field can only be modified by an authenticated administrative user. Recommendations: For Pega...

IBM Maximo Application Suite Cross-Site Scripting Vulnerability

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. A security vulnerability exists in IBM Maximo Application Suite version 8.9, version 8.10, and IBM Maxim...

PT-2023-23733 · Ibm · Ibm Maximo Application Suite +1

Name of the Vulnerable Software and Affected Versions: IBM Maximo Application Suite versions 8.9 through 8.10 IBM Maximo Asset Management versions 7.6.1.2 through 7.6.1.3 Description: A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web...

Cross site scripting

Multiple stored cross-site scripting XSS vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML via the key comment to different pages such as public key details, Export key, sign key, send to key server page, and fetch from key server page tab...

CVE-2023-41316

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

Design/Logic Flaw

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

CVE-2023-41316 HTML Injection with email in Tolgee

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

CVE-2023-41316 HTML Injection with email in Tolgee

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

CVE-2023-41316

CVE-2023-41316 affects Tolgee (open‑source localization platform) where lack of validation in the Org Name field allows HTML injection into unsanitized invitation emails sent by registered users. The vulnerability can enable directing recipients to malicious sites or executing JavaScript in the u...

CVE-2023-41316 HTML Injection with email in Tolgee

Tolgee is an open-source localization platform. Due to lack of validation field - Org Name, bad actor can send emails with HTML injected code to the victims. Registered users can inject HTML into unsanitized emails from the Tolgee instance to other users. This unsanitized HTML ends up in invitati...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter...

Security Bulletin: IBM Maximo Asset Management is vulnerable to HTML injection (CVE-2023-32332)

Summary IBM Maximo Asset Management is vulnerable to HTML injection. Vulnerability Details CVEID:CVE-2023-32332 DESCRIPTION: IBM Maximo Application Suite is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web...

Tolgee Input Validation Error Vulnerability

Tolgee is an open source multilingual translation and localization platform designed to help development teams easily manage and maintain multilingual software applications and websites. An input validation error vulnerability exists in Tolgee version v3.29.1 and prior versions, which stems from...

Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to HTML Injection (CVE-2023-32332)

Summary IBM Maximo Manage application in IBM Maximo Application Suite is vulnerable to HTML Injection. Vulnerability Details CVEID:CVE-2023-32332 DESCRIPTION: IBM Maximo Application Suite is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would...

CVE-2023-41944

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...

CVE-2023-41944

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...

Design/Logic Flaw

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...

CVE-2023-41944

Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rendering an error message, resulting in an HTML injection vulnerability...