CVE-2019-13975

eGain Chat 15.0.3 allows HTML Injection...

CVE-2019-13975

CVE-2019-13975 : The supplied connected documents identify an HTML Injection vulnerability in eGain Chat 15.0.3 . The CVSS details indicate a network-accessible issue with low to moderate impact: base CVSS v3.0 score 6.1 (vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), with no availability...

CVE-2019-15814

Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML...

GitLab HTML Injection Vulnerability (CNVD-2019-31316)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An HTML injection vulnerability exists in GitLab Enterpri...

Nextcloud: XSS in desktop client via invalid server address on login form

Team! I have found this vulnerability that in my time would be called "cross zone" but at the moment I don't know. The problem is found in the latest version of "nextcloud.exe" for your windows version. The problem occurs with the initial screen where you ask to connect to a website. Apparently...

FreeBSD : Gitlab -- Multiple Vulnerabilities (b68cc195-cae7-11e9-86e9-001b217b3468)

Gitlab reports : Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure Use...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Kubernetes Integration Server-Side Request Forgery Server-Side Request Forgery in Jira Integration Improved Protection Against Credential Stuffing Attacks Markdown Clientside Resource Exhaustion Pipeline Status Disclosure Group Runner Authorization Issue CI Metrics Disclosure User...

CVE-2019-15700

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...

CVE-2019-15700

The CVE-2019-15700 issue affects public/js/frappe/form/footer/timeline.js in Frappe Framework 12 up to 12.0.8, where HTML is not escaped in the timeline, enabling crafted text such as “changed value of.” Root cause is lack of HTML escaping in that JavaScript file. Public details in connected docu...

CVE-2019-15700

public/js/frappe/form/footer/timeline.js in Frappe Framework 12 through 12.0.8 does not escape HTML in the timeline and thus is affected by crafted "changed value of" text...

CVE-2018-18668

GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "homepage title" parameter, aka the adm/configformupdate.php cftitle parameter...

CVE-2019-11584

CVE-2019-11584 affects Atlassian Jira versions prior to 8.3.2, where the MigratePriorityScheme resource is vulnerable to a cross-site scripting (XSS) attack via the priority icon URL of an issue priority. Exploitation is remote and, per the public records, may require user interaction; successful...

CVE-2019-15331

The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...

CVE-2019-15331

The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...

Design/Logic Flaw

The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...

CVE-2019-15331

The wp-support-plus-responsive-ticket-system plugin before 9.1.2 for WordPress has HTML injection...

CVE-2019-15331

The CVE-2019-15331 entry concerns the WordPress plugin wp-support-plus-responsive-ticket-system, affected in all versions prior to 9.1.2. Multiple connected sources confirm a vulnerability described as HTML injection / stored cross-site scripting (XSS) in this plugin. The vulnerability stems from...

Escalation of Privilege in Twistlock

An HTML injection vulnerability has been identified in the Twistlock Console that can lead to a DOM based XSS attack under certain configurations. Ref , CVE-2019-1583 Successful exploitation of this vulnerability allows a Twistlock user with Operator capabilities to escalate privileges to that of...

Cforms & CformsII <= 15.0.1 - Unauthenticated HTML Injection & CSRF

...

WordPress CformsII plugin <= 15.0.1 - Unauthenticated HTML Injection & Cross-Site Request Forgery (CSRF) vulnerabilities

Unauthenticated HTML Injection & Cross-Site Request Forgery CSRF vulnerabilities found by Jerome Bruandet Nintechnet in WordPress CformsII plugin versions = 15.0.1. Solution Update the WordPress CformsII plugin to the latest available version at least 15.0.2...