IBM WebSphere Portal Cross-Site Scripting Vulnerability (CNVD-2018-20233)

IBM WebSphere Portal is a suite of enterprise portal software from IBM. The software creates a platform that connects the internal and external parts of an organization, allowing employees, customers and suppliers to access internal data through the platform. A cross-site scripting vulnerability...

PT-2018-1946

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 7.0 through 9.0 Description The issue exists due to insufficient protection of the web page structure, allowing a remote attacker to embed arbitrary JavaScript code in the web interface, potentially leading to...

PT-2018-13411

Name of the Vulnerable Software and Affected Versions IBM Rational DOORS Next Generation versions 5.0 through 5.0.2 IBM Rational DOORS Next Generation versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionalit...

PT-2018-1944

Name of the Vulnerable Software and Affected Versions IBM WebSphere Portal versions 8.0 through 9.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2018-13632

Name of the Vulnerable Software and Affected Versions IBM Rational Engineering Lifecycle Manager versions 5.0 through 5.02 IBM Rational Engineering Lifecycle Manager versions 6.0 through 6.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intend...

Cross-Site Scripting (XSS)

dojo is vulnerable to cross-site scripting. User input is not sanitized in the server response before being displayed on a user's browser. An attacker is able to inject arbitrary Javascript into a victim's browser through a crafted URL via the status parameter...

Cross-site Scripting (XSS)

atmosphere-runtime is vulnerable to a cross-site scripting XSS attack. The library does not properly escape the JSONP callback parameter when passed to the server, allowing a malicious user to inject and execute arbitrary Javascript through it...

TradingView Cross-Site Scripting Vulnerability

TradingView Charting Library is an open source and free K chart analysis tool, with a comprehensive API. support for ordinary json data UDF, there is also support for websocket JSAPI, most of the digital currency exchanges use this component library as a K line analysis tool. TradingView has a...

PT-2018-5320

Name of the Vulnerable Software and Affected Versions IBM Campaign versions 9.1 through 10 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Cross-Site Scripting (XSS)

rack-mini-profiler is vulnerable to cross-site scripting. The user info displayed in Error 404 pages is not HTML encoded which could potentially allow an attacker to inject arbitrary Javascript code into a victim's browser...

Cross-site Scripting (XSS)

mayan-edms is vulnerable to cross-site scripting XSS attacks. The library does not properly escape tag labels, allowing a malicious user to inject and execute arbitrary Javascript...

Cross-site Scripting (XSS)

exceljs is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the cells in the table, allowing a malicious user to inject and execute arbitrary Javascript...

X (Formerly Twitter): HTTPS is not validating TLS mac codes

https://twitterflightschool.com is prone to POODLE and also a stronger variant of POODLE which allows a MITM attacker to actively decrypt bytes from an HTTPS request. This attack is possible because the device terminating this TLS connection responds differently to a bad record mac when the last...

QNAP Photo Station Cross-Site Scripting Vulnerability

QNAP Photo Station is a web-based photo album application from QNAP Systems that supports organizing and sharing photos and movies on a NAS over the Internet. A cross-site scripting vulnerability exists in QNAP Photo Station 5.7.0 and prior versions. A remote attacker can exploit the vulnerabilit...

CVE-2018-13395: Improper Neutralization of Input During Web Page Generation

Various resources in Atlassian Jira before version 7.6.8, from version 7.7.0 before version 7.7.5, from version 7.8.0 before version 7.8.5, from version 7.9.0 before version 7.9.3, from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML ...

CVE-2018-0715

Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application...

PortSwigger Web Security: Browser Self XSS Protection not implemented

Hi Self XSS Protection not used ,An attacker can trick users to insert JavaScript in browser console. A Self-XSS scam usually works by promising to help you access somebody else's account. Instead, the scammer tricks you into gaining access to your account for fraud, spam and tricking more people...

Cross-Site Scripting (XSS)

Mort Bay jetty is vulnerable to cross-site scripting XSS. The server response from a directory listing request is not sanitized and allows an attacker to inject arbitrary Javascript into a victim's browser via a ; semicolon character...

CVE-2018-0715: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in QNAP Photo Station versions 5.7.0 and earlier could allow remote attackers to inject Javascript code in the compromised application...

PT-2018-9034

Name of the Vulnerable Software and Affected Versions QNAP Photo Station versions 5.7.0 and earlier Description A cross-site scripting issue could allow remote attackers to inject Javascript code into the compromised application. Recommendations For QNAP Photo Station versions 5.7.0 and earlier,...