6886 matches found
PT-2021-12126
Name of the Vulnerable Software and Affected Versions: IBM Jazz Foundation products affected versions not specified Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...
How Page Integrity Manager Detects Real-World Magecart Attacks
Written by Ziv Eli - Engineering Manager, Security and Maor Hod - Senior Product Manager, Security In this blog, we will take a look at and break down a recent Magecart attack detected and mitigated by Page Integrity Manager. The impacted customer operates a large international e-commerce busines...
CVE-2020-4865
IBM Jazz Foundation products is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 190741...
CVE-2021-21259
HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instanc...
Authentication flaw
HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instanc...
CVE-2021-21259
HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instanc...
CVE-2021-21259
CVE-2021-21259 affects HedgeDoc before version 1.7.2, where an attacker could inject arbitrary JavaScript into a note that is executed when viewed in slide mode. Depending on instance configuration, authentication may not be required to create or edit notes. The issue is fixed in HedgeDoc 1.7.2; ...
CVE-2021-22849
Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...
CVE-2021-22849
CVE-2021-22849 affects Hyweb HyCMS-J1; the backend editing function does not filter special characters, enabling stored XSS where logged-in users can inject JavaScript. Root cause: insufficient input sanitization on editing payloads. Documented impact includes stored XSS risk with potential parti...
PT-2021-14368
Name of the Vulnerable Software and Affected Versions: HedgeDoc versions prior to 1.7.2 Description: HedgeDoc is open source software that allows users to create real-time collaborative markdown notes. An attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the no...
PT-2021-15222
Name of the Vulnerable Software and Affected Versions Hyweb HyCMS-J1 affected versions not specified Description The backend editing function of Hyweb HyCMS-J1 does not filter special characters, allowing users who are logged in to inject JavaScript syntax and perform a stored XSS Stored Cross-si...
CVE-2021-21259: Improper Neutralization of Input During Web Page Generation
HedgeDoc is open source software which lets you create real-time collaborative markdown notes. In HedgeDoc before version 1.7.2, an attacker can inject arbitrary JavaScript into a HedgeDoc note, which is executed when the note is viewed in slide mode. Depending on the configuration of the instanc...
Hyweb HyCMS-J Cross-Site Scripting Vulnerability
Hyweb HyCMS-J1 is a text management system from the Chinese company Hyweb. Hyweb HyCMS-J1 suffers from a cross-site scripting vulnerability that stems from the back-end editing function not filtering special characters. An attacker can exploit this vulnerability to inject JavaScript syntax to...
Hedgedoc Cross-Site Script Vulnerability
Hedgedoc is a Javascript-based Markdown document real-time editing and sharing platform by the Hedgedoc team. A cross-site scripting vulnerability exists in versions prior to HedgeDoc 1.7.2, which can be exploited by attackers to inject arbitrary JavaScript...
U.S. Dept Of Defense: Stored XSS at https://www.█████████.mil
Summary: Stored XSS exists at https://www.██████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Description: Stored XSS exists at https://www.████.mil. A user can fill out the form and upload a file containing javascript code to trigger XSS. Impact ...
Cross site scripting
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...
CVE-2020-35582
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...
PT-2021-14515
Name of the Vulnerable Software and Affected Versions SAP BusinessObjects Business Intelligence platform versions 410, 420 Description The issue allows an authenticated attacker to inject malicious JavaScript payload into the custom value input field of an Input Control. This can be executed by a...
Opentext Carbonite Cross-Site Script Vulnerability
OpenText develops and markets Enterprise Information Management EIM software. A cross-site scripting vulnerability exists in OpenText Carbonite Server Backup Portal 8.8.7 and earlier versions, which originates from a failure to effectively filter user input at policy creation, allowing an...