CVE-2020-11593

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address...

CVE-2020-11593

An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP POST request with injected HTML data that is later leveraged to send emails from a customer trusted email address...

PT-2020-12709

Name of the Vulnerable Software and Affected Versions CIPPlanner CIPAce version 9.1 Build 2019092801 Description An issue allows an unauthenticated attacker to make an HTTP POST request with injected HTML data. This injected data is later used to send emails from a customer's trusted email addres...

GitLab: Stored XSS in markdown when redacting references

Summary It's possible to inject arbitrary html into the markdown by abusing the ReferenceRedactorFilter. This is due to the data-original attribute allowing html encoded data to be stored, which is then extracted and used as the link content. If the original data already is html encoded then it...

PT-2020-4991

Name of the Vulnerable Software and Affected Versions КТС «Маяк» affected versions not specified Description The issue is related to the lack of input data sanitization in the web interface, which could allow a remote attacker to inject arbitrary web scripts or HTML code. Recommendations At the...

Rocket.Chat: [Security Vulnerability Rocket.chat] HTML Injection into Email via Signup

Description Due to a lack of sanitization and validation in parameter affected, we can input HTML Tag and system will render it into Email victim. Affected Endpoint https://chat.oas.greenhost.net/home Parameter : Name Step to produce In textbox name, input HTML code like "\”@x.y " And in Email,...

Micro Focus Vibe 4.0.6 HTML Injection

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2019-046 Product: Micro Focus Vibe formerly Novelle Vibe Manufacturer: Micro Focus International plc Affected Versions: 4.0.6 Tested Versions: 4.0.6 Vulnerability Type: HTML Injection CWE-79 Risk Level: Low Solution Status: Fixed...

CVE-2020-5339

RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript...

CVE-2020-5559

Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5552

Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5559

Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5552: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in mailform version 1.04 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2020-18534

Name of the Vulnerable Software and Affected Versions WL-Enq versions 1.11 through 1.12 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions 1.11 and 1.12, update to a version that contains a fix for this issue...

CVE-2020-5339: Improper Neutralization of Input During Web Page Generation

RSA Authentication Manager versions prior to 8.4 P10 contain a stored cross-site scripting vulnerability in the Security Console. A malicious RSA Authentication Manager Security Console administrator with advanced privileges could exploit this vulnerability to store arbitrary HTML or JavaScript...

CVE-2020-5559: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2020-5557: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2020-18527

Name of the Vulnerable Software and Affected Versions mailform version 1.04 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which can lead to cross-site scripting. Recommendations For mailform version 1.04, consider disabling the featu...

Stored XSS via malicious file upload - CVE-2020-14173

The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. Affected versions version 8.5.4 8.6.0 ≤ version ≤ 8.7.0 8.7.0 ≤ version 8.7.1 Fixed versions 8.5.4 8.7...

Grandstream UCM6200 SQL Injection Vulnerability (CNVD-2020-23201)

The Grandstream UCM6200 is an enterprise-class switch for IP telephony communications from Grandstream. An SQL injection vulnerability exists in the HTTP interface of the Grandstream UCM6200 versions prior to 1.0.19.20 and 1.0.20.17, which can be exploited by an attacker to execute shell commands...