PT-2020-19763

Name of the Vulnerable Software and Affected Versions lightning-server affected versions not specified Description The issue allows for the injection of malicious JavaScript code as part of a session controller, potentially leading to unauthorized access or control. Recommendations At the moment,...

HUAWEI Mate 20 JavaScript Injection Vulnerability

Huawei Mate 20 is a smartphone from Chinese company Huawei Huawei. An injection vulnerability exists in previous versions of Huawei HUAWEI Mate 20 10.1.0.163 C00E160R3P8, which stems from a module that does not perform input checksums on specific inputs. An attacker can exploit this vulnerability...

CVE-2020-9092

HUAWEI Mate 20 versions earlier than 10.1.0.163C00E160R3P8 have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module...

CVE-2020-9092

HUAWEI Mate 20 versions earlier than 10.1.0.163C00E160R3P8 have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module...

CVE-2020-9092

CVE-2020-9092 affects Huawei Mate 20 devices running versions earlier than 10.1.0.163 (C00E160R3P8). The issue is a JavaScript injection vulnerability where a module does not verify specific input, allowing attackers to bypass the filter mechanism and inject JavaScript, potentially compromising t...

CVE-2020-9092

HUAWEI Mate 20 versions earlier than 10.1.0.163C00E160R3P8 have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module...

CVE-2019-13633

Blinger.io v1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can inject arbitrary JavaScript through built-in communication channels (Telegram, WhatsApp, Viber, Skype, Facebook, Vkontakte, Odnoklassniki), with exploitation impacting the admin-conversation panels: /conversations/all, /c...

CVE-2020-9092: Improper Neutralization of Input During Web Page Generation

HUAWEI Mate 20 versions earlier than 10.1.0.163C00E160R3P8 have a JavaScript injection vulnerability. A module does not verify a specific input. This could allow attackers to bypass filter mechanism to launch JavaScript injection. This could compromise normal service of the affected module...

PT-2020-20486

Name of the Vulnerable Software and Affected Versions HUAWEI Mate 20 versions earlier than 10.1.0.163C00E160R3P8 Description The issue is related to a JavaScript injection vulnerability. A module does not properly verify a specific input, which could allow attackers to bypass the filter mechanism...

Design/Logic Flaw

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...

Exploit for Cross-site Scripting in Olimpoks Olimpok

CVE-2020-16270 Suggested description: OLIMPOKS under 3...

CVE-2020-6319

SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticated attacker to include JavaScript blocks in any web page or URL with different symbols which are otherwise not allowed. On successful exploitation an attacker can steal...

CVE-2020-14184

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1...

PT-2020-18199

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2020-14184: Improper Neutralization of Input During Web Page Generation

Affected versions of Atlassian Jira Server allow remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in Jira issue filter export files. The affected versions are before 8.5.9, from version 8.6.0 before 8.12.3, and from version 8.13.0 before 8.13.1...

PT-2020-18200

Name of the Vulnerable Software and Affected Versions IBM Security Guardium version 11.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2020-26574

Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a...

CVE-2020-26574

Leostream Connection Broker 8.2.x is affected by a stored XSS via the webquery.pl User-Agent header. An unauthenticated attacker can inject JavaScript that is rendered when admins log in, potentially forcing the admin to upload a malicious Perl script that could be executed as root through libMis...

PT-2020-16465 · Leostream · Leostream Connection Broker

Name of the Vulnerable Software and Affected Versions: Leostream Connection Broker versions 8.2.x Description: The issue allows an unauthenticated attacker to inject arbitrary JavaScript code via the User-Agent HTTP header in the webquery.pl file. This code is rendered by administrators the next...

CVE-2019-20903

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerability in link targets...