GHSA-C392-WHPC-VFPR Apache Airflow vulnerable to Improper Encoding or Escaping of Output

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

Stored Cross Site Scripting (XSS)

WSO2 is vulnerable to Stored Cross Site Scripting XSS. The vulnerability is due to improper output encoding. This issue can be exploited by an attacker by injecting malicious JavaScript payloads into the Registry feature of the Management Console...

GHSA-RFQ3-WPJH-PPVG WSO2 Registry Stored Cross Site Scripting (XSS) vulnerability

WSO2 Registry has been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

Cross site scripting

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

CVE-2023-6911

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

CVE-2023-6911: Improper Neutralization of Input During Web Page Generation

Multiple WSO2 products have been identified as vulnerable due to improper output encoding, a Stored Cross Site Scripting XSS attack can be carried out by an attacker injecting a malicious payload into the Registry feature of the Management Console...

Cross-Site Scripting in mermaid

Versions of mermaid prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as A"" is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding. Recommendation Upgrade to version 8.2.3 or later...

PT-2020-21536

Name of the Vulnerable Software and Affected Versions mermaid versions prior to 8.2.3 Description The issue allows for Cross-Site Scripting attacks. If malicious input, such as A"", is provided to the application, it will execute the code instead of rendering it as text due to improper output...

Exploit for Improper Encoding or Escaping of Output in F5 Nginx

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID is not explicitly stated, but the repository contains various vulnerable environments and exploits for different vulnerabilities, including CVE-2016-9086, CVE-2017-1000353, CVE-2013-4547,...

Contao Output Improperly Encoded or Escaped Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. An improper output encoding or escaping vulnerability exists in Contao versions 4.8.4 and 4.8.5. An attacker can exploit this vulnerability by...

PT-2019-15924

Name of the Vulnerable Software and Affected Versions Contao versions 4.8.4 through 4.8.5 Description The issue concerns improper encoding or escaping of output, allowing the injection of insert tags into the login module. These tags are replaced when the page is rendered. Recommendations For...

CVE-2019-9852: Improper Encoding or Escaping of Output

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

PT-2019-19999

Name of the Vulnerable Software and Affected Versions ids-enterprise versions prior to 4.18.2 Description The issue affects the soho-dropdown component, which does not properly encode its output. This may allow attackers to execute arbitrary JavaScript, resulting in a Cross-Site Scripting XSS...

Cross-site Scripting (XSS)

mermaid is vulnerable to Cross-Site Scripting. Due to improper output encoding, a malicious input such as A"" can be provided to the application, allowing a remote attacker to execute arbitrary Javascript on the victim's browser...

Design/Logic Flaw

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security...

CVE-2018-1547: Undefined Security Weakness

IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security...

PT-2018-13038

Name of the Vulnerable Software and Affected Versions IBM Robotic Process Automation with Automation Anywhere version 10.0 Description The issue is caused by improper output encoding in a CSV export, which could allow a remote attacker to execute arbitrary code on the system. An attacker could...