CVE-2019-16156

An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5, 6.2.0, and 6.1.1 may allow a remote unauthenticated attacker to perform a Cross Site Scripting attack XSS...

CVE-2020-0700: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability exists when Azure DevOps Server does not properly sanitize user provided input, aka 'Azure DevOps Server Cross-site Scripting Vulnerability'...

PT-2020-2061

Name of the Vulnerable Software and Affected Versions Andover Continuum All versions Description A Cross-site Scripting vulnerability exists, which could cause a Reflective Cross-site Scripting attack when using the product's web server. This issue is related to the improper neutralization of inp...

Druva inSync Mac OS Client Code Instruction Improper Neutralization Vulnerability

Druva inSync Client is a lightweight application for managing data backups and allowing collaboration with other users.Druva inSync Mac OS Client is the Mac OS version. Druva inSync Mac OS Client 6.5.0 suffers from an improperly neutralized instruction vulnerability in dynamic evaluation code. A...

D-Link DGS-1250 Header Injection

D-Link DGS-1250 header injection vulnerability ============================================== The latest version of this advisory is available at: https://sintonen.fi/advisories/d-link-dgs-1250-header-injection.txt Overview -------- D-Link DGS-1250 switch is susceptible to a header injection...

CVE-2020-6392: Improper Neutralization of Input During Web Page Generation

Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension...

CVE-2011-1084: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in Smoothwall Express 3...

CVE-2019-15619

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project...

PT-2020-9742

Name of the Vulnerable Software and Affected Versions Nextcloud Server version 16.0.3 Nextcloud Talk version 6.0.3 Nextcloud Deck version 0.6.5 Description The issue is related to the improper neutralization of file names, conversation names, and board names. This causes a cross-site scripting XS...

CVE-2019-15586: Improper Neutralization of Input During Web Page Generation

A XSS exists in Gitlab CE/EE 12.1.10 in the Mermaid plugin...

CVE-2020-8421: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in comactionlogs...

Sql injection

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in susestudio-ui-server of SUSE Studio onsite allows remote attackers with admin privileges in Studio to alter SQL statements, allowing for extraction and modification of data. This issue affects:...

CVE-2013-0286: Improper Neutralization of Input During Web Page Generation

Pinboard 1.0.6 theme for Wordpress has XSS...

CVE-2020-6843: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine ServiceDesk Plus 11.0 Build 11007 allows XSS. This issue was fixed in version 11.0 Build 11010, SD-83959...

CVE-2020-5853: Improper Neutralization of Input During Web Page Generation

In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict...

CVE-2019-14862: Improper Neutralization of Input During Web Page Generation

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...

CVE-2019-14863: Improper Neutralization of Input During Web Page Generation

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it...

CVE-2013-4692: Improper Neutralization of Input During Web Page Generation

Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS...

CVE-2019-13181: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability exists in the web UI of SolarWinds Serv-U FTP Server v15.1.7...

CVE-2019-17123: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The eGain Web Email API 11+ allows spoofed messages because the fromName and message fields to /system/ws/v11/ss/email are mishandled, as demonstrated by fromName header injection with a %0a or %0d character. Also, the message parameter can have initial HTML comment characters...