IBM Rational Rhapsody Design Manager and IBM Rational Software Architect Design Manager Cross-Site Scripting Vulnerabilities

IBM Rational Rhapsody Design Manager is collaborative design management software built on the IBM Jazz platform that helps design team members and stakeholders share, track, review, and manage designs.IBM Rational Software Architect Design Manager is a IBM Rational Software Architect Design Manag...

PT-2018-12983

Name of the Vulnerable Software and Affected Versions IBM Rational Rhapsody Design Manager versions 5.0 through 5.0.2 IBM Rational Rhapsody Design Manager versions 6.0 through 6.0.5 IBM Rational Software Architect Design Manager versions 5.0 through 5.0.2 IBM Rational Software Architect Design...

PT-2018-13239

Name of the Vulnerable Software and Affected Versions IBM Rational Rhapsody Design Manager versions 5.0 through 5.0.2 IBM Rational Rhapsody Design Manager versions 6.0 through 6.0.5 IBM Rational Software Architect Design Manager versions 5.0 through 5.0.2 IBM Rational Software Architect Design...

PT-2018-12994

Name of the Vulnerable Software and Affected Versions IBM Rational Rhapsody Design Manager versions 5.0 through 5.0.2 and 6.0 through 6.0.5 IBM Rational Software Architect Design Manager versions 5.0 through 5.0.2 and 6.0 through 6.0.1 Description This issue allows users to embed arbitrary...

PT-2018-12953

Name of the Vulnerable Software and Affected Versions IBM Rational DOORS Next Generation versions 5.0 through 5.0.2 IBM Rational DOORS Next Generation versions 6.0 through 6.0.5 IBM Rational Requirements Composer versions 5.0 through 5.0.2 Description This issue allows users to embed arbitrary...

Atlassian JIRA Server Cross-Site Scripting Vulnerability (CNVD-2018-18120)

Atlassian JIRA Server is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all kinds of problems and defects in the work. A cross-site scripting vulnerability exists in the IncomingMailServers resource in Atlassian JIRA Server. A remote...

CVE-2017-17541

A Cross-site Scripting XSS vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below versions allows inject Javascript code and HTML tags through the CN value of CA and CRL certificates via the import CA and CRL certificates feature...

CVE-2018-5229

The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the name of user submitted add-on names...

macOS/iOS - JavaScript Injection Bug in OfficeImporter

QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code using OfficeImport and renders it using WebKit. The...

macOS / iOS - JavaScript Injection Bug in OfficeImporter Exploit

Exploit for multiple platform in category dos / poc QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code usi...

macOSiOS - JavaScript Injection Bug in OfficeImporter

macOSiOS - JavaScript Injection Bug in OfficeImporter QuickLook is a widely used feature in macOS/iOS which allows you to preview various formats such as pdf, docx, pptx, etc. The way it uses to show office files is quite interesting. First it parses the office file and converts it to HTML code...

Shopify: Preview bar: Incomplete message origin validation results in XSS

The JavaScript code at https://cdn.shopify.com/s/assets/storefront/bars/previewbarinjector-73a4756a265c637c998799750759ae548e7f68b136e8e93e83132904afc3d30d.js loaded by the shop front when a theme is previewed installs a message event listener. The following check is used to reject invalid event...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-23248)

IBM Rational Quality Manager is the collaborative center for business-driven software and system quality across virtually any platform and any type of test. The software helps teams seamlessly share information, use automation to accelerate projects, and report metrics for targeted release...

IBM Rational Quality Manager Cross-Site Scripting Vulnerability (CNVD-2018-23251)

IBM Rational Quality Manager is the collaborative center for business-driven software and system quality across virtually any platform and any type of test. The software helps teams seamlessly share information, use automation to accelerate projects, and report metrics for targeted release...

Fortinet FortiAnalyzer Cross-Site Scripting Vulnerability (CNVD-2018-13761)

Fortinet FortiManager and FortiAnalyzer are both products of Fortinet, Inc. Fortinet FortiManager is a centralized network security management solution.FortiAnalyzer is a centralized network security reporting solution. A cross-site scripting vulnerability exists in Fortinet FortiManager version...

IBM Rational Team Concert Cross-Site Scripting Vulnerability (CNVD-2018-23254)

IBM Rational Team Concert RTC is the U.S. IBM's set of Jazz-based platform and support for decentralized teams for real-time collaboration related to software lifecycle management solutions. A cross-site scripting vulnerability exists in IBM RTC versions 5.0 through 5.0.2 and 6.0 through 6.0.5. A...

Pornhub: Stored XSS on the https://www.redtube.com/users/[profile]/collections

Researcher successfully closed the image 'alt' attribute and injected javascript by submitting an XSS payload as the collection title. This led to stored cross-site scripting on the user's collections page, executed against any users who visited the user's collections. The user's favorites page w...

Stored Cross-site Scripting Vulnerabilities in Qingdao Easoft Tianchuang Ranzhi Collaboration Management System (QDTMS)

Ranch Coworking Management System is an enterprise coworking system. A stored cross-site scripting vulnerability exists in several places in Ranzhi Collaboration Management System. Attackers can insert malicious js code in the page to get user cookies and other information, resulting in user...

CVE-2018-13388: Improper Neutralization of Input During Web Page Generation

The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in attached files...

PT-2018-12256

Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager versions 5.0 through 5.0.2 IBM Rational Quality Manager versions 6.0 through 6.0.5 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and...