CVE-2019-16178

LimeSurvey prior to 3.17.14 is affected by a stored XSS vulnerability that allows authenticated users with appropriate permissions to inject arbitrary script or HTML via the titles of admin box buttons on the home page. Root cause is input in button titles not properly sanitized before rendering....

CVE-2019-15944

CVE-2019-15944 affects Counter-Strike: Global Offensive, specifically community game servers, with the issue described as displaying unsafe HTML in a disconnection message prior to 2019-08-29. Supported documents confirm the target is CS:GO game servers and the vulnerability arises from unsafe HT...

CVE-2019-15944: Improper Encoding or Escaping of Output

In Counter-Strike: Global Offensive before 8/29/2019, community game servers can display unsafe HTML in a disconnection message...

iswgoa3z.sportsretriever.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-955962 Security Researcher geeknik Helped patch 8722 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting iswgoa3z.sportsretriever.co...

CVE-2019-13975

eGain Chat 15.0.3 allows HTML Injection...

CVE-2019-13975

eGain Chat 15.0.3 allows HTML Injection...

Design/Logic Flaw

eGain Chat 15.0.3 allows HTML Injection...

CVE-2019-13975

eGain Chat 15.0.3 allows HTML Injection...

CVE-2019-13975

CVE-2019-13975 : The supplied connected documents identify an HTML Injection vulnerability in eGain Chat 15.0.3 . The CVSS details indicate a network-accessible issue with low to moderate impact: base CVSS v3.0 score 6.1 (vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with no availability...

CVE-2019-15814

Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML...

PT-2019-13504

Name of the Vulnerable Software and Affected Versions eGain Chat version 15.0.3 Description The issue allows for HTML Injection. Recommendations For version 15.0.3, update to a newer version that contains a fix for this issue...

CVE-2019-15814: Improper Neutralization of Input During Web Page Generation

Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML...

PT-2019-14404

Name of the Vulnerable Software and Affected Versions Sentrifugo version 3.2 Description The issue concerns multiple stored XSS vulnerabilities. These vulnerabilities could allow authenticated users to inject arbitrary web script or HTML. Recommendations For Sentrifugo version 3.2, update to a...

GitLab HTML Injection Vulnerability (CNVD-2019-31316)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An HTML injection vulnerability exists in GitLab Enterpri...

Nextcloud: XSS in desktop client via invalid server address on login form

Team! I have found this vulnerability that in my time would be called "cross zone" but at the moment I don't know. The problem is found in the latest version of "nextcloud.exe" for your windows version. The problem occurs with the initial screen where you ask to connect to a website. Apparently...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b68cc195-cae7-11e9-86e9-001b217b3468)

Gitlab reports : Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure Use...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure User...

CVE-2018-15512: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the 'Authorisation Service' feature of totemomail 6.0.0 build 570 allows remote attackers to inject arbitrary web script or HTML...

CVE-2019-15700

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...

CVE-2019-15700

The CVE-2019-15700 issue affects public/js/frappe/form/footer/timeline.js in Frappe Framework 12 up to 12.0.8, where HTML is not escaped in the timeline, enabling crafted text such as “changed value of.” Root cause is lack of HTML escaping in that JavaScript file. Public details in connected docu...