CVE-2023-33257

Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat...

CVE-2023-33257

CVE-2023-33257 affects Verint Engagement Management 15.3 Update 2023R2, with an HTML injection (XSS) vulnerability in the live chat user data form. Root cause cited across sources is insufficient filtering/escaping of user-supplied data in user data forms, enabling injection of arbitrary HTML/scr...

CVE-2023-33257

Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat...

PT-2023-24250 · Verint · Verint Engagement Management

Name of the Vulnerable Software and Affected Versions: Verint Engagement Management version 15.3 Update 2023R2 Description: The issue concerns HTML injection via the user data form in the live chat. This allows for potential malicious code injection. Recommendations: For Verint Engagement...

HTML injection Leads to Open redirection

Description HTML Injection Leads to Open Redirection is a dangerous web security issue. Attackers inject malicious HTML code into vulnerable websites, allowing them to execute harmful scripts in users' browsers. This may lead to unauthorized actions on users' behalf and redirect them to malicious...

Security Bulletin: Multiple vulnerabilities in Golang Go affect IBM Spectrum Copy Data Management components that leverage Go.

Summary Multiple vulnerabilities in Golang Go affect IBM Spectrum Copy Data Management components that leverage Go essentially VADP 'VM' backup. Vulnerabilities include gaining elevated privileges to read or write the contents of the registers. execution of arbitrary code on the system, execute i...

HTML Injection Leads To Open Redirect

Description HTML injection is possible in the Installation title parameter, which leads to Open Redirect when clicked. Proof of Concept Open Redirect 1. Login as Admin 2. Navigate to settings 3. Edit the Installation title and set it to: Click Me 4. Save Changes 5. Click the Click Me text on the...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Golang Go ( CVE-2023-29400)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Golang Go, due to an exposure in HTML code templates CVE-2023-29400. Golang Go is included in the operators used by our Speech Services. This vulnerabilitiy has been addressed. Please read t...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go (CVE-2023-24539).

Summary Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go, due to a weakness in a template containing multiple actions separated by a '/' character CVE-2023-24539. Go is included in the operators used by our Speech Services...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go [CVE-2023-24540]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to HTML injection in Go, due to a weakness in a template containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029". Go is included in the operators used by our Speech Services...

CVE-2023-3971

An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise...

Red Hat Ansible automation controller 跨站脚本漏洞

Red Hat Ansible automation controller is a centralized management tool from Red Hat, Inc. It is used for managing inventory, initiating and scheduling workflows, tracking changes, and integrating reports with a centralized user interface. A security vulnerability exists in the Red Hat Ansible...

Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by multiple vulnerabilities in Golang Go

Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Golang Go. The below vulnerabilities have been addresssed. Vulnerability Details CVEID:CVE-2023-24534 DESCRIPTION: Golang Go is vulnerable to a denial of service, caused by an memory exhaustion in t...

Stored html injection on segment name

Description I have found an HTML Injection vulnerability on your web application. HTML injection is a type of injection vulnerability that occurs when a user is able to control an input point and is able to inject arbitrary HTML code into a vulnerable web page. Note : I am recreating the report a...

CVE-2023-33229

The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML...

The vulnerability of the SAP NetWeaver Design Time Repository, a software integration platform, allows a hacker to inject arbitrary HTML code.

The vulnerability of the SAP NetWeaver Design Time Repository software platform exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to inject arbitrary HTML code remotely...

PT-2023-24234 · Solarwinds · Solarwinds Platform

Name of the Vulnerable Software and Affected Versions: SolarWinds Platform affected versions not specified Description: The issue allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject passive HTML, due to incorrect input neutralization...

Security Bulletin: IBM Event Streams is affected by multiple Golang Go vulnerabilities

Summary There are a number of vulnerabilities in Golang Go used by IBM Event Streams CVE-2023-29400, CVE-2023-24540, CVE-2023-24539, CVE-2023-24536, CVE-2023-24537, CVE-2023-24538. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Go is vulnerable ...

Cisco Small Business SPA500 Series IP Phones HTML Injection Vulnerability

Cisco Small Business SPA500 Series IP Phones is an SPA500 series IP phone from Cisco USA. The Cisco Small Business SPA500 Series IP Phones suffer from an HTML injection vulnerability that can be exploited by an attacker to redirect users to potentially malicious websites by convincing them to cli...

Contact Form Builder by Bit Form < 2.2.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Create a Blank form or select...