16060 matches found
Design/Logic Flaw
TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code...
CVE-2020-23050
TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code...
CVE-2020-23050
TAO Open Source Assessment Platform v3.3.0 RC02 contains a HTML injection vulnerability in the userFirstName field of the user account input. The issue enables phishing, external redirects, and arbitrary code execution. Root cause is HTML injection in the userFirstName parameter. Related advisori...
PT-2021-10826 · Unknown · Tao Open Source Assessment Platform
Name of the Vulnerable Software and Affected Versions: TAO Open Source Assessment Platform version 3.3.0 RC02 Description: The issue allows attackers to execute phishing attacks, external redirects, and arbitrary code due to a HTML injection vulnerability in the userFirstName parameter of the use...
TikTok: HTML Injection via TikTok Ads Email Share
A HTML injection was found on a TikTok Ads endpoint via the "SenderName" parameter. We thank @lu3ky-13 for reporting this to our team...
Portlandlabs Concrete5 Cross-Site Scripting Vulnerability (CNVD-2021-94046)
Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "rel" parameter to inject arbitrary web scri...
Cross site scripting
A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...
HackerOne: HTML injection in email at https://www.hackerone.com/
HTML injection was possible in emails sent via the HackerOne platform by filling the first name and last name fields with HTML tags on the pentest community application form. This could allow an attacker to send malicious emails and inject HTML into them...
CVE-2021-32609
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...
CVE-2021-32609
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...
Design/Logic Flaw
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...
EUVD-2021-0021
Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...
CVE-2021-32609
CVE-2021-32609: Apache Superset up to 1.1 is affected by an XSS vulnerability on the Explore page due to unsanitized chart titles. An attacker with Explore access can save a chart with a malicious title, injecting HTML (including scripts) into the page. Connected sources (BIT-SUPERSET-2021-32609,...
PT-2021-19806 · Apache · Apache Superset
Name of the Vulnerable Software and Affected Versions: Apache Superset versions up to and including 1.1 Description: The issue allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page, due to incorrect sanitization of titles on...
Juniper Junos OS Vulnerability (JSA11220)
The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11220 advisory. - A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to...
Verint Systems Verint Workforce Optimization Injection Vulnerability
Verint Systems Verint Workforce Optimization WFO is an employee performance management solution from Verint Systems, Inc. The product supports workforce management, call logging, automated quality management, performance management, text and desktop analytics, etc. An injection vulnerability exis...
in fisharebest/webtrees
Description The program allows to upload files with dangerous file types in the media upload section, leading to XSS and other exploits like shell uploads, HTML injection leading to Social Engineering attacks, etc ..., I have demonstrated HTML file upload leading to XSS here. Proof of Concept mov...
CVE-2021-37958
CVE-2021-37958 affects Google Chrome/Chromium: Inappropriate implementation in Navigation on Windows before 94.0.4606.54 allows a remote attacker to inject scripts/HTML into a privileged page via a crafted HTML page. Connected sources reference Chrome/Chromium updates addressing this issue (e.g.,...
