Design/Logic Flaw

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124524...

CVE-2017-1248

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

CVE-2017-1242

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124524...

CVE-2017-1248

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

Cross site scripting

Cross-site scripting XSS vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted attribute name of an Attribute...

CVE-2017-1329

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 126231...

CVE-2017-1248

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124628...

CVE-2017-1329

IBM Quality Manager (RQM) is affected by an HTML injection vulnerability identified as CVE-2017-1329. Affected: Rational Quality Manager 5.0.x and 6.0–6.0.5; the issue allows remote HTML injection executed in the browser within the hosting site’s security context. Remediation: upgrade 6.0.x to 6....

CVE-2017-1242

IBM Security Bulletin confirms CVE-2017-1242 affects IBM Rational Quality Manager (RQM) in Rational CLM 5.0–5.0.2 and 6.0–6.0.5. The issue is an HTML injection that lets a remote attacker have HTML execute in a user’s browser in the hosting site’s context. Remediation: upgrade to RQM 6.0.4+ (or 6...

CVE-2017-1248

CVE-2017-1248 affects IBM Rational Quality Manager (RQM) 5.0.x and 6.0–6.0.5, with an HTML injection flaw that could execute code in a user’s browser within the hosting site’s context. The IBM bulletin A27047ED73E7AE4D822B59EB4E55C43E9EF28F36E8CF4AFFCD62BFF92FCC5593 lists this CVE among multiple ...

CVE-2017-1242

IBM Quality Manager RQM 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 124524...

Privilege Escalation

ASP.NET Core is vulnerable to privilege escalation. This is due to Kestrel web application failing to validate web requests which could result in HTML injection attacks to trigger a "password reset" email on behalf of a target user...

PAN-OS cross-site scripting vulnerability (CNVD-2018-13464)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A cross-site scripting vulnerability exists in the PAN-OS session browser in Palo Alto Networks PAN-OS. An attacker could exploit this vulnerability to inject arbitrary JavaScript...

PAN-OS cross-site scripting vulnerability (CNVD-2018-13468)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A cross-site scripting vulnerability exists in the PAN-OS Web interface administration page in Palo Alto Networks PAN-OS. An attacker could exploit this vulnerability to inject...

CVE-2018-9337

The PAN-OS web interface administration page in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.17 and earlier, PAN-OS 8.0.10 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...

CVE-2018-3747

The public node module versions = 1.0.3 allows to embed HTML in file names, which in certain conditions might lead to execute malicious JavaScript...

CVE-2018-7636

The URL filtering "continue page" hosted by PAN-OS 8.0.10 and earlier may allow an attacker to inject arbitrary JavaScript or HTML via specially crafted URLs...

CVE-2018-9335

The PAN-OS session browser in PAN-OS 6.1.20 and earlier, PAN-OS 7.1.16 and earlier, PAN-OS 8.0.9 and earlier, and PAN-OS 8.1.1 and earlier may allow an attacker to inject arbitrary JavaScript or HTML...

CVE-2017-0912

CVE-2017-0912 affects Ubiquiti UCRM versions 2.5.0 to 2.7.7. The vulnerability is a stored Cross-site Scripting (XSS) flaw caused by insufficient sanitization, enabling injection of arbitrary HTML via the uploaded filename. Exploitation requires valid credentials and an account with Edit access t...

CVE-2018-7636

PAN-OS 8.0.10 and earlier are affected by CVE-2018-7636 — a Cross-Site Scripting flaw in the URL filtering “continue page” that allows injection of arbitrary JavaScript/HTML via crafted URLs. The issue affects PAN-OS 8.0.x (and not 8.1.x/7.1.x/6.1.x as stated in advisories) and is addressed by ve...