CVE-2020-12137

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

IBM WebSphere Application Server 7.0.0.0 <= 7.0.0.45 / 8.0.0.0 <= 8.0.0.15 / 8.5.0.0 <= 8.5.5.14 / 9.0.0.0 <= 9.0.0.9 Cross-Site Scripting Vulnerability

A cross-site scripting XSS vulnerability exists in WebSphere Application Server using SIBMsgMigration Utility due to improper validation of user-supplied input before returning it to users. An authenticated, remote attacker can exploit this, by embeding arbitrary JavaScript code in the Web UI thu...

Code injection

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

PT-2020-18418 · Rsa · Emc Rsa Authentication Manager

Name of the Vulnerable Software and Affected Versions: RSA Authentication Manager versions prior to 8.4 P11 Description: The issue concerns a stored cross-site scripting vulnerability in the Security Console of RSA Authentication Manager. A malicious administrator with advanced privileges could...

Cross site scripting

A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the "Server Config" web interface of the affected devices that could allow an attacker to inject...

CVE-2020-7575

A vulnerability has been identified in Climatix POL908 BACnet/IP module All versions, Climatix POL909 AWM module All versions V11.32. A persistent cross-site scripting XSS vulnerability exists in the web server access log page of the affected devices that could allow an attacker to inject arbitra...

Cross-Site Scripting (XSS)

firefox / thunderbird is vulnerable to cross-site scripting XSS. A cross-site scripting XSS flaw was found in the way Firefox handled certain multibyte character sets. A web page containing malicious content could cause Firefox to run JavaScript code with the permissions of a different website...

Cross-Site Scripting (XSS)

thunderbird is vulnerable to cross-site scripting XSS. A cross-site scripting XSS flaw was found in the way Thunderbird handled certain multibyte character sets. Malicious, remote content could cause Thunderbird to run JavaScript code with the permissions of different remote content...

CVE-2020-4252

IBM DOORS Next Generation DNG/RRC 6.0.2. 6.0.6, and 6.0.61 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

Apple Safari Flaws Enable One-Click Webcam Access

A security researcher has disclosed vulnerabilities in Apple’s Safari browser that can be used to snoop on iPhones, iPads and Mac computers using their microphones and cameras. To exploit the flaws in a real-world attack, all an attacker would need to do is convince a victim to click one maliciou...

CVE-2020-8823

A cross-site scripting XSS vulnerability was found in the Node.js library, sockjs. An attacker could use this vulnerability to supply a query string with script tags, which could trick a victim into executing a specially crafted JavaScript code...

Sql injection

An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attacker may be able to cause arbitrary javascript code execution...

CVE-2020-3884

An injection issue was addressed with improved validation. This issue is fixed in macOS Catalina 10.15.4. A remote attacker may be able to cause arbitrary javascript code execution...

CVE-2020-3884

Summary: CVE-2020-3884 is an injection issue in the Mail component of macOS Catalina that allowed a remote attacker to cause arbitrary JavaScript execution. The issue was addressed by improved input validation and is fixed in macOS Catalina 10.15.4. The primary sources describe the vulnerability ...

CVE-2019-10180

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service TPS did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting XSS vulnerability. An attacker able to modify the parameters of any token could...

CVE-2019-10180

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service TPS did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting XSS vulnerability. An attacker able to modify the parameters of any token could...

Cross site scripting

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service TPS did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting XSS vulnerability. An attacker able to modify the parameters of any token could...

F5 Networks BIG-IP : BIG-IP APM Portal Access vulnerability (K73183618)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.2 / 12.1.5.2 / 14.1.2.5 / 15.0.1.3 / 15.1.0.2 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K73183618 advisory. InBIG-IP APM Portal Access, HTTP pages that are served by back-end serve...

CVE-2020-1771

Attacker is able craft an article with a link to the customer address book with malicious content JavaScript. When agent opens the link, JavaScript code is executed due to the missing parameter encoding. This issue affects: OTRS Community Edition: 6.0.26 and prior versions. OTRS: 7.0.15 and prior...

Qulture.Rocks: XSS from arbitrary attachment upload.

Summary: The New Comment feature in the OKRs page allows a user to upload an arbitrary file. I was able to upload HTML file that contains Javascript code. The Javascript code will execute when victim access visits the attachment. Steps To Reproduce: 1. Upload an HTML file that contains javascript...