Design/Logic Flaw

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749

The CVE-2020-7749 issue affects all versions of osm-static-maps where user input is passed directly to a template without escaping ({{{ ... }}}). This enables injection of arbitrary HTML/JS, leading to XSS in the rendered page and, in server contexts (e.g., Puppeteer), potential SSRF and Local Fi...

TinyMCE 5 HTML Injection

Exploit Title: iframe Injection\Html Injection TinyMCE 5 HTML WYSIWYG Date:18.10.2020 Author: Vincent666 ibn Winnie Software Link: https://www.tiny.cloud/features/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest-vincent.blogspot.com/ PoC:...

Cross site scripting

Multiple stored cross-site scripting XSS vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations Best-fit Mapping, as demonstrated by the full-width variants of the less-than sign...

CVE-2020-13893

CVE-2020-13893 affects Sage EasyPay 10.7.5.10 with multiple stored XSS vulnerabilities. The issue arises from handling Unicode Transformations (Best-fit Mapping), enabling authenticated attackers to inject arbitrary web script or HTML via multiple parameters, demonstrated by full-width variants o...

CVE-2020-16270

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...

Basecamp: Possible DOM XSS on app.hey.com

Summary: Hello Team, While testing it was observed that on https://app.hey.com/, on Search box there is a possibility of XSS. Although the payload is reflected in the DOM but the CSP blocks the execution of the script, the XSS can happen if the CSP is somehow bypassed. The Subject parameter is...

CVE-2020-26583

An issue was discovered in Sage DPW 202006x before 202006002. It allows unauthenticated users to upload JavaScript in a file via the expenses claiming functionality. However, to view the file, authentication is required. By exploiting this vulnerability, an attacker can persistently include...

CVE-2020-7318

Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator ePO prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized...

CVE-2020-24188

Cross-site scripting XSS vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web script or HTML via the request parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web script or HTML via the request parameter...

CVE-2020-8821

Affected software: Webmin 1.941 and earlier. Root cause: Improper data validation in the Command Shell Endpoint allows HTML to be submitted in the Command field; HTML is rendered in Action Logs and across users, with no JavaScript execution. Impact: HTML rendering in logs and cross-user persisten...

CVE-2020-4740

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150...

Design/Logic Flaw

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150...

CVE-2020-4740

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150...

CVE-2020-4740

CVE-2020-4740 applies to IBM InfoSphere Information Server 11.5 and 11.7, where an HTML-injection vulnerability could allow a remote attacker to inject HTML that runs in the victim’s browser within the hosting site’s security context. The IBM Security bulletin confirms the issue and lists affecte...

CVE-2020-14184

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1...

CVE-2020-14184

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to HTML injection.

Summary An HTML injection vulnerability was addressed in IBM InfoSphere Information Server. Vulnerability Details CVEID: CVE-2020-4740 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be...

CVE-2020-4740

IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 188150...