Portlandlabs Concrete5 Cross-Site Scripting Vulnerability (CNVD-2021-94046)

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "rel" parameter to inject arbitrary web scri...

Cross site scripting

A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...

HackerOne: HTML injection in email at https://www.hackerone.com/

HTML injection was possible in emails sent via the HackerOne platform by filling the first name and last name fields with HTML tags on the pentest community application form. This could allow an attacker to send malicious emails and inject HTML into them...

CVE-2021-32609

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

CVE-2021-32609

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

EUVD-2021-0021

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

Design/Logic Flaw

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

CVE-2021-32609

CVE-2021-32609: Apache Superset up to 1.1 is affected by an XSS vulnerability on the Explore page due to unsanitized chart titles. An attacker with Explore access can save a chart with a malicious title, injecting HTML (including scripts) into the page. Connected sources (BIT-SUPERSET-2021-32609,...

PT-2021-19806 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset versions up to and including 1.1 Description: The issue allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page, due to incorrect sanitization of titles on...

Juniper Junos OS Vulnerability (JSA11220)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11220 advisory. - A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to...

Verint Systems Verint Workforce Optimization Injection Vulnerability

Verint Systems Verint Workforce Optimization WFO is an employee performance management solution from Verint Systems, Inc. The product supports workforce management, call logging, automated quality management, performance management, text and desktop analytics, etc. An injection vulnerability exis...

in fisharebest/webtrees

Description The program allows to upload files with dangerous file types in the media upload section, leading to XSS and other exploits like shell uploads, HTML injection leading to Social Engineering attacks, etc ..., I have demonstrated HTML file upload leading to XSS here. Proof of Concept mov...

CVE-2021-37958

CVE-2021-37958 affects Google Chrome/Chromium: Inappropriate implementation in Navigation on Windows before 94.0.4606.54 allows a remote attacker to inject scripts/HTML into a privileged page via a crafted HTML page. Connected sources reference Chrome/Chromium updates addressing this issue (e.g.,...

CVE-2021-37958

Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page...

CVE-2021-37958

Inappropriate implementation in Navigation in Google Chrome on Windows prior to 94.0.4606.54 allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page...

CVE-2021-41825

Verint Workforce Optimization WFO 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter...

CVE-2021-41825

Verint Workforce Optimization WFO 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter...

Design/Logic Flaw

Verint Workforce Optimization WFO 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter...

CVE-2021-41825

Verint Workforce Optimization WFO 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter...

CVE-2021-41918

webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the...