CVE-2017-18892

CVE-2017-18892 affects Mattermost Server prior to 4.2.0, 4.1.1, and 4.0.5, where an Email template field can contain HTML content that is not neutralized, enabling potential HTML/Script injection via that field. Remediation: upgrade to Mattermost versions 4.0.5-rc1, 4.1.1-rc1, 4.2.0-rc3 or newer....

XSS in WYSIWYG editor via pasted code - CVE-2020-14164

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in the WYSIWYG editor. The affected versions are before 8.5.9, and from version 8.6.0 before 8.8.2. Affected versions: version...

CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

DEBIAN-CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

Hardcoded credentials

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

CVE-2020-4046 Authenticated XSS through embed block in WordPress

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

CVE-2020-4046

CVE-2020-4046 affects WordPress: low-privilege users can abuse the embed block to inject unfiltered HTML in the block editor, enabling script execution when viewed by a higher-privilege user. Impact is described as editor/wp-admin script execution. The issue has been patched in WordPress 5.4.2 an...

CVE-2020-4046

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

xuper.com Improper Access Control vulnerability OBB-1191868

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Open-Xchange: XSS on opening malicious OpenOffice presentation document

Title Opening a malicious OpenOffice presentation document may lead to cross site scripting XSS attacks Description When generating HTML content for a master slides present in odp file, a div is generated by Container.java. The attribute data-container-id of this div is directly constructed from...

BlockDev Sp. Z o.o: Email HTML injection

Email HTML injection...

CVE-2020-1327

A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'...

CVE-2020-1327

A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'...

CVE-2020-1327

A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests, aka 'Azure DevOps Server HTML Injection Vulnerability'...

Azure DevOps Server HTML Injection Vulnerability

A spoofing vulnerability exists in Microsoft Azure DevOps Server when it fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive information. An...

Security Updates for Microsoft Team Foundation Server (June 2020)

The Microsoft Team Foundation Server is missing security updates. It is, therefore, affected by an HTML injection vulnerability due to not properly sanitizing user inputs. An unauthenticated, remote attacker can exploit this to perform script or content injection attacks, which could trick a user...

Nord Security: Reflected XSS via IE

The reporter has found an HTML injection that lead to XSS with several payloads. It is important to note that this attack vector was only applicable via Internet Explorer. In addition, Microsoft is gradually ending support for Internet Explorer 11 within 2020/2021...

Cross-site Scripting (XSS)

Overview jspdf is a PDF Document creation from JavaScript Affected versions of this package are vulnerable to Cross-site Scripting XSS. It's possible to inject JavaScript code via the html method. PoC var doc = new jsPDF; window.html2canvas = html2canvas; let html = a ; doc.htmlhtml, callback:...

Atlassian Fisheye and Crucible Cross-Site Scripting Vulnerabilities (CNVD-2020-31427)

Atlassian Fisheye and Crucible are both products of the Australian company Atlassian, Atlassian Fisheye is a suite of in-depth viewers of source code and Crucible is a suite of code review tools. A cross-site scripting vulnerability exists in Atlassian Fisheye and Crucible versions prior to 4.8.2...