Infogram: Stored XSS in infogram.com via language

The stored XSS was found in the language profile parameter. POC: Change profile settings with following request: http PUT /api/users/me HTTP/1.1 Host: infogram.com User-Agent: Mozilla/5.0 X11; Linux x8664; rv:63.0 Gecko/20100101 Firefox/63.0 Accept: / Accept-Language: en-US,en;q=0.5...

IBM WebSphere Commerce Cross-Site Scripting Vulnerability (CNVD-2018-22091)

IBM WebSphere Commerce is a suite of e-commerce solutions from IBM in the United States. The solution supports all sales business models, including B2C, B2B and B2B2C, on a single customer interaction platform. A cross-site scripting vulnerability exists in IBM WebSphere Commerce. A remote attack...

Stored Cross-site Scripting Vulnerability in S-CMS E-commerce System

S-CMS e-commerce system is an e-commerce software. A stored cross-site scripting vulnerability exists in the S-CMS e-commerce system. An attacker can insert malicious js code into a page to obtain user cookies and other information, leading to user hijacking...

AjentiCP 1.2.23.13 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Title: AjentiCP 1.2.23.13 - Cross-Site Scripting Author: Numan OZDEMIR https://infinitumit.com.tr Vendor Homepage: ajenti.org Software Link: https://github.com/ajenti/ajenti Version: Up to v1.2.23.13 CVE: CVE-2018-18548 Description: Attacker c...

AjentiCP 1.2.23.13 - Cross-Site Scripting

Title: AjentiCP 1.2.23.13 - Cross-Site Scripting Author: Numan OZDEMIR https://infinitumit.com.tr Vendor Homepage: ajenti.org Software Link: https://github.com/ajenti/ajenti Version: Up to v1.2.23.13 CVE: CVE-2018-18548 Description: Attacker can inject JavaScript codes without Ajenti privileges b...

AjentiCP 1.2.23.13 Cross Site Scripting

Title: AjentiCP Dir Name Based Stored XSS dir 2- Open this directory in File Manager tool in Ajenti server admin panel. // for secure days...

CVE-2018-10141

GlobalProtect Portal Login page in Palo Alto Networks PAN-OS before 8.1.4 allows an unauthenticated attacker to inject arbitrary JavaScript or HTML...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-20549)

IBM Rational Quality Manager RQM is a collaborative, Web-based quality management solution from IBM. The program provides test planning and test evaluation management methods within the entire software development lifecycle, and the ability to share information, automation to accelerate the proje...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-20547)

IBM Rational Quality Manager RQM is a collaborative, Web-based quality management solution from IBM. The program provides test planning and test evaluation management methods within the entire software development lifecycle, and the ability to share information, automation to accelerate the proje...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-20548)

IBM Rational Quality Manager RQM is a collaborative, Web-based quality management solution from IBM. The program provides test planning and test evaluation management methods within the entire software development lifecycle, and the ability to share information, automation to accelerate the proje...

IBM Rational Collaborative Lifecycle Management Cross-Site Scripting Vulnerability (CNVD-2018-20674)

IBM Rational Collaborative Lifecycle Management is a suite of collaborative design model management software from IBM in the United States. The software supports the use of centralized system repositories for storing, sharing, searching and managing design models, as well as automated software...

Cross-site Scripting (XSS)

coastercms is vulnerable to cross-site scripting XSS attacks. A malicious user can pass a POST request to the application to inject and execute arbitrary Javascript...

Cross-Site Scripting (XSS)

intelliants/subrion is vulnerable to cross-site scripting. An attacker is able to inject arbitrary Javascript into a victim's browser via the titlesen parameter in core/admin/pages/add/ to steal session cookies or perform unwanted actions on behalf of the user...

CVE-2018-14037

Cross-site scripting XSS vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload...

Cross site scripting

Cross-site scripting XSS vulnerability in Progress Kendo UI Editor v2018.1.221 allows remote attackers to inject arbitrary JavaScript into the DOM of the WYSIWYG editor because of the editorNS.Serializer toEditableHtml function in kendo.all.min.js. If the victim accesses the editor, the payload...

IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2018-20233)

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects the internal and external parts of an organization, allowing employees, customers and suppliers to access internal data through the platform. A cross-site scripting vulnerability...

Cross-Site Scripting (XSS)

dojo is vulnerable to cross-site scripting. User input is not sanitized in the server response before being displayed on a user's browser. An attacker is able to inject arbitrary Javascript into a victim's browser through a crafted URL via the status parameter...

Cross-site Scripting (XSS)

atmosphere-runtime is vulnerable to a cross-site scripting XSS attack. The library does not properly escape the JSONP callback parameter when passed to the server, allowing a malicious user to inject and execute arbitrary Javascript through it...

TradingView Cross-Site Scripting Vulnerability

TradingView Charting Library is an open source and free K chart analysis tool, with a comprehensive API. support for ordinary json data UDF, there is also support for websocket JSAPI, most of the digital currency exchanges use this component library as a K line analysis tool. TradingView has a...