8740 matches found
Cross site scripting
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...
CVE-2020-7937
An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site...
CVE-2020-7937
CVE-2020-7937 is an XSS vulnerability in the title field of Plone 5.0–5.2.1. The issue allows users with a certain privilege level to inject JavaScript that executes for other site visitors. The core vulnerability is in the title field handling, enabling stored or reflected XSS depending on conte...
PT-2020-19859
Name of the Vulnerable Software and Affected Versions Plone versions 5.0 through 5.2.1 Description A cross-site scripting XSS issue exists in the title field, allowing users with a certain privilege level to insert JavaScript code. This code will be executed when other users access the site...
PYSEC-2020-162
In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...
Cross-Site Scripting
Overview All versions of atlasboard-atlassian-package prior to 0.4.2 are vulnerable to Cross-Site Scripting XSS. The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers bei...
DEBIAN-CVE-2020-1766
Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered as inline jpg file. This issue affects: OTRS Community Edition 5.0.x version 5.0.39 and prior...
PT-2020-15043 · Otrs +2 · Otrs Community Edition +2
Name of the Vulnerable Software and Affected Versions: OTRS Community Edition versions 5.0.39 and prior versions OTRS Community Edition versions 6.0.24 and prior versions OTRS Community Edition versions 7.0.13 and prior versions Description: The issue arises from improper handling of uploaded...
UBUNTU-CVE-2019-17020
If an XML file is served with a Content Security Policy and the XML file includes an XSL stylesheet, the Content Security Policy will not be applied to the contents of the XSL stylesheet. If the XSL sheet e.g. includes JavaScript, it would bypass any of the restrictions of the Content Security...
Automattic: Theme Assets uploader allows HTML content
The reporter submitted a report highlighting that specially formatted yet valid HTML files were able to be uploaded as theme assets. Even though we allow for JavaScript on our blog network, we don't allow HTML files to be uploaded here so that we can restrict JavaScript execution to the blog...
CVE-2019-18652
A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...
CVE-2019-18652
A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...
CVE-2019-18652: Improper Neutralization of Input During Web Page Generation
A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3, allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and...
PT-2020-9979
Name of the Vulnerable Software and Affected Versions: WatchGuard XMT515 versions prior to 12.1.3 Description: A DOM based XSS issue allows a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The issue was tested in Microsoft...
IBM Financial Transaction Manager for SWIFT Services Multiple Security Vulnerabilities
Description IBM Financial Transaction Manager for SWIFT Services is prone to the following security vulnerabilities: 1. A clickjacking vulnerability 2. A cross-site scripting vulnerability 3. An information-disclosure vulnerability 4. A cross-site request-forgery vulnerability An attacker can...
CVE-2019-7621
Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting XSS flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboa...
CVE-2019-8792
An injection issue was addressed with improved validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...
CVE-2019-8792
An injection issue was addressed with improved validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...
PT-2019-18673
Name of the Vulnerable Software and Affected Versions Kibana versions prior to 6.8.6 Kibana versions prior to 7.5.1 Description The issue is related to a cross site scripting XSS flaw in the coordinate and region map visualizations. An attacker who can create coordinate map visualizations could...
CVE-2019-7621: Improper Neutralization of Input During Web Page Generation
Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting XSS flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboa...