Online Inventory Manager 3.2 - Persistent Cross-Site Scripting

Exploit Title: Online Inventory Manager 3.2 - Persistent Cross-Site Scripting Date: 2019-11-29 Exploit Author: Cemal Cihad ÇİFTÇİ Vendor Homepage: https://bigprof.com Software Link : https://bigprof.com/appgini/applications/online-inventory-manager Software : Online Inventory Manager Version : 3....

PT-2019-5794

Name of the Vulnerable Software and Affected Versions cordova-plugin-inappbrowser versions prior to 3.1.0 Description The issue is related to the Cordova In-App-Browser extension for Android, where a lack of protection for the web page structure can be exploited. This allows a remote attacker to...

CVE-2019-18654: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS issue exists in AVG AntiVirus Internet Security Edition 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

PT-2019-8778

Name of the Vulnerable Software and Affected Versions Mautic versions 2.11.0 and earlier Mautic version 2.13.1 Description An issue was discovered that allows for Stored XSS via the company name field. This Cross Site Scripting XSS vulnerability can result in denial of service and execution of...

CVE-2019-9140 Happypoint mobile application information disclosure vulnerability

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

CVE-2019-9140: Improper Control of Generation of Code

When processing Deeplink scheme, Happypoint mobile app 6.3.19 and earlier versions doesn't check Deeplink URL correctly. This could lead to javascript code execution, url redirection, sensitive information disclosure. An attacker can exploit this issue by enticing an unsuspecting user to open a...

PT-2019-19384

Name of the Vulnerable Software and Affected Versions Happypoint mobile app versions 6.3.19 and earlier Description The issue arises when the Happypoint mobile app processes Deeplink schemes, failing to correctly check the Deeplink URL. This can lead to the execution of javascript code, url...

CVE-2019-5458: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in http-file-server all versions allows an attacker with access to the server file system to execute arbitrary JavaScript code in victim's browser...

PT-2019-11493

Name of the Vulnerable Software and Affected Versions: Jsish version 2.4.84 Description: The issue affects the Jsi ValueArrayIndex function in jsiValue.c at line 366, allowing for denial of service through crafted JavaScript code execution. Recommendations: For Jsish version 2.4.84, update to a...

CVE-2019-1010091

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

Input validation

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

CVE-2019-1010091

CVE-2019-1010091 affects TinyMCE 4.7.11/4.7.12 (Media element). The root cause is improper input neutralization (CWE-79) in the media element, enabling JavaScript execution when a user pastes malicious content into the media element embed tab. Impact is client-side code execution with low attack ...

CVE-2019-1010091

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

CVE-2019-1010091

Removed by vendor...

CVE-2019-1010091: Improper Neutralization of Input During Web Page Generation

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

PT-2019-11438

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 2.3.1 Zammad versions prior to 2.2.2 Zammad versions prior to 2.1.3 Description: The issue allows an attacker to execute JavaScript code on a user's browser, leveraging a Cross Site Scripting XSS weakness. This can...

CVE-2019-1010008

OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting XSS. The impact is: Theoretically low, but might potentially enable persistent XSS user could embed mal. code. The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "M...

CVE-2019-1010008

OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting XSS. The impact is: Theoretically low, but might potentially enable persistent XSS user could embed mal. code. The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "M...

Cross site scripting

OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting XSS. The impact is: Theoretically low, but might potentially enable persistent XSS user could embed mal. code. The component is: Javascript code execution in "Name", "Location", "Bio" and "Starting Page" fields in the "M...

CVE-2019-0303

SAP BusinessObjects Business Intelligence Platform Administration Console, versions 4.2, 4.3, module BILogon/appService.jsp is reflecting requested parameter errMsg into response content without sanitation. This could be used by an attacker to build a special url that execute custom JavaScript co...