CVE-2019-10213: Improper Output Neutralization for Logs

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

CVE-2019-14858: Improper Output Neutralization for Logs

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argumentspec with sub parameters marked as nolog, passing an invalid parameter name to the module will cause the task to fail before the nolog options in the sub parameters are processe...

PT-2019-13859

Name of the Vulnerable Software and Affected Versions PRiSE adAS version 1.7.0 Description An issue was discovered where the OPENSSO module does not properly escape output on error, leading to reflected XSS. Recommendations For PRiSE adAS version 1.7.0, consider disabling the OPENSSO module until...

CVE-2019-9852: Improper Encoding or Escaping of Output

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

PT-2019-19999

Name of the Vulnerable Software and Affected Versions ids-enterprise versions prior to 4.18.2 Description The issue affects the soho-dropdown component, which does not properly encode its output. This may allow attackers to execute arbitrary JavaScript, resulting in a Cross-Site Scripting XSS...

Cross-site Scripting (XSS)

mermaid is vulnerable to Cross-Site Scripting. Due to improper output encoding, a malicious input such as A"" can be provided to the application, allowing a remote attacker to execute arbitrary Javascript on the victim's browser...

CVE-2019-6504: Improper Neutralization of Input During Web Page Generation

Insufficient output sanitization in the Automic Web Interface AWI, in CA Automic Workload Automation 12.0 to 12.2, allow attackers to potentially conduct persistent cross site scripting XSS attacks via a crafted object...

CVE-2018-10932: Improper Output Neutralization for Logs

lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal...

Design/Logic Flaw

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security...

CVE-2018-1547: Undefined Security Weakness

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security...

PT-2018-13038

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 10.0 Description The issue is caused by improper output encoding in a CSV export, which could allow a remote attacker to execute arbitrary code on the system. An attacker could...

UBUNTU-CVE-2016-6810

In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation...

Oracle Linux 7 : freeradius (ELSA-2017-2389)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2389 advisory. - Related: Bug1469414 CVE-2017-10984 freeradius: Out-of-bounds write in data2vpwimax - Resolves: Bug1469409 CVE-2017-10978 freeradius: Out-of-bounds...

Meneame cross-site scripting vulnerability

Overview Meneame, an open source social bookmark system, contains a cross-site scripting vulnerability. Meneame, an open-source web application to build social bookmark systems, contains a cross-site scripting vulnerability, as it does not properly handle output data. Impact A remote attacker cou...