CVE-2018-10139

The PAN-OS response for GlobalProtect Gateway in Palo Alto Networks PAN-OS 6.1.21 and earlier, PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11 and earlier may allow an unauthenticated attacker to inject arbitrary JavaScript or HTML. PAN-OS 8.1 is NOT affected...

IBM Rhapsody Model Manager Cross-Site Scripting Vulnerability

IBM Rhapsody Model Manager is a suite of collaborative design model management software from IBM. The software supports the use of centralized system repositories for storing, sharing, searching and managing design models, as well as automated software design reviews. A cross-site scripting...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2018-14693)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...

WordPress Mondula Multi Step Form Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Mondula Multi Step Form is used in one of the drag-and-drop form builder plugin . A cross-site scripting...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2018-13986)

IBM Sterling B2B Integrator is a suite of software from IBM USA that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting vulnerability exists in IBM Sterling B...

Storage-based Cross-site Scripting Vulnerability in School Worry-free Enterprise Website System v1.7

School carefree enterprise website system Xiao5uCompany is a set of company and enterprise-oriented website building system. A stored cross-site scripting vulnerability exists in XiaowuCompany v1.7. An attacker can use the vulnerability to insert malicious js code into the page, obtain user cooki...

IBM Rational Rhapsody Design Manager and IBM Rational Software Architect Design Manager Cross-Site Scripting Vulnerabilities

IBM Rational Rhapsody Design Manager is collaborative design management software built on the IBM Jazz platform that helps design team members and stakeholders share, track, review, and manage designs.IBM Rational Software Architect Design Manager is a IBM Rational Software Architect Design Manag...

Atlassian JIRA Server Cross-Site Scripting Vulnerability (CNVD-2018-18120)

Atlassian JIRA Server is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of problems and defects in the work. A cross-site scripting vulnerability exists in the IncomingMailServers resource in Atlassian JIRA Server. A remote...

CVE-2017-17541

A Cross-site Scripting XSS vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature...

CVE-2018-5229

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of user submitted add-on names...

macOSiOS - JavaScript Injection Bug in OfficeImporter

macOSiOS - JavaScript Injection Bug in OfficeImporter QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code...

macOS / iOS - JavaScript Injection Bug in OfficeImporter Exploit

Exploit for multiple platform in category dos / poc QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code usi...

macOS/iOS - JavaScript Injection Bug in OfficeImporter

QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code using OfficeImport and renders it using WebKit. The...

Shopify: Preview bar: Incomplete message origin validation results in XSS

The JavaScript code at https://cdn.shopify.com/s/assets/storefront/bars/previewbarinjector-73a4756a265c637c998799750759ae548e7f68b136e8e93e83132904afc3d30d.js loaded by the shop front when a theme is previewed installs a message event listener. The following check is used to reject invalid event...

IBM Rational Team Concert Cross-Site Scripting Vulnerability (CNVD-2018-23254)

IBM Rational Team Concert RTC is the U.S. IBM's set of Jazz-based platform and support for decentralized teams for real-time collaboration related to software lifecycle management solutions. A cross-site scripting vulnerability exists in IBM RTC versions 5.0 through 5.0.2 and 6.0 through 6.0.5. A...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-23248)

IBM Rational Quality Manager is the collaborative center for business-driven software and system quality across virtually any platform and any type of test. The software helps teams seamlessly share information, use automation to accelerate projects, and report metrics for targeted release...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-23251)

IBM Rational Quality Manager is the collaborative center for business-driven software and system quality across virtually any platform and any type of test. The software helps teams seamlessly share information, use automation to accelerate projects, and report metrics for targeted release...

Fortinet FortiAnalyzer Cross-Site Scripting Vulnerability (CNVD-2018-13761)

Fortinet FortiManager and FortiAnalyzer are both products of Fortinet, Inc. Fortinet FortiManager is a centralized network security management solution.FortiAnalyzer is a centralized network security reporting solution. A cross-site scripting vulnerability exists in Fortinet FortiManager version...

Pornhub: Stored XSS on the https://www.redtube.com/users/[profile]/collections

Researcher successfully closed the image 'alt' attribute and injected javascript by submitting an XSS payload as the collection title. This led to stored cross-site scripting on the user's collections page, executed against any users who visited the user's collections. The user's favorites page w...

Stored Cross-site Scripting Vulnerabilities in Qingdao Easoft Tianchuang Ranzhi Collaboration Management System (QDTMS)

Ranch Coworking Management System is an enterprise coworking system. A stored cross-site scripting vulnerability exists in several places in Ranzhi Collaboration Management System. Attackers can insert malicious js code in the page to get user cookies and other information, resulting in user...