PT-2019-15728

Name of the Vulnerable Software and Affected Versions SnowHaze versions prior to 2.6.6 Description The issue arises when SnowHaze is sometimes too late to honor a per-site JavaScript blocking setting. This can lead to unintended JavaScript execution via a chain of webpage redirections targeted to...

Cross-site Scripting in Grav

Grav through 1.6.15 allows Stored Cross-Site Scripting due to JavaScript execution in SVG images...

CVE-2019-13081

Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via the title field in the /common/ticketassociatedtickets.php service desk ticket functionality that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser...

Design/Logic Flaw

Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability via an SVG image and HTML file that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser...

About the security content of Shazam iOS App Version 12.11.0 - Apple Support

About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page. Apple security documents reference...

Redhat Quay CVE-2019-3865 HTML Injection Vulnerability

Description Redhat Quay is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-bas...

CVE-2019-18667

/usr/local/www/freeradiusviewconfig.php in the freeradius3 package before 0.15.73 for pfSense on FreeBSD allows a user with an XSS payload as password or username to execute arbitrary javascript code on a victim browser...

PT-2019-15567

Name of the Vulnerable Software and Affected Versions freeradius3 package versions prior to 0.15.7 3 for pfSense on FreeBSD Description The issue allows a user with an XSS payload as username or password to execute arbitrary JavaScript code on a victim's browser. This is due to a vulnerability in...

CVE-2019-18654

A Cross Site Scripting XSS issue exists in AVG AntiVirus Internet Security Edition 19.3.3084 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

CVE-2019-18653

A Cross Site Scripting XSS issue exists in Avast AntiVirus Free, Internet Security, and Premiere Edition 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

CVE-2019-18653: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS issue exists in Avast AntiVirus Free, Internet Security, and Premiere Edition 19.3.2369 build 19.3.4241.440 in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name...

PT-2019-15555

Name of the Vulnerable Software and Affected Versions Avast AntiVirus versions 19.3.2369 build 19.3.4241.440 Description A Cross Site Scripting XSS issue exists in the Network Notification Popup, allowing an attacker to execute JavaScript code via an SSID Name. Recommendations For Avast AntiVirus...

Cross-Site Scripting (XSS)

apache-airflow is vulnerable to cross-site scripting XSS. An administrative user is able to edit the state of objects in the metadata database to contain malicious Javascript, which will execute in a victim's browser when rendered. This vulnerability also allows reading of arbirary files permitte...

Arbitrary file deletion

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...

CVE-2019-12417

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...

PT-2019-12794

Name of the Vulnerable Software and Affected Versions Apache Airflow affected versions not specified Description A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views, presenting a Local File Disclosure...

Google Chrome Code Injection Vulnerability

Google Chrome is a web browser from Google, an American company. A code injection vulnerability exists in versions of Google Chrome prior to 78.0.3904.70, which stems from the program not performing proper input validation when processing CSS files. An attacker can exploit the vulnerability to...

PT-2019-15364

Name of the Vulnerable Software and Affected Versions Ant Design Pro version 4.0.0 Description The issue concerns a reflected XSS in the user/login redirect GET parameter, which affects the authorization component. This leads to the execution of JavaScript code in the login after-action script...

PT-2019-13307

Name of the Vulnerable Software and Affected Versions MindPalette NateMail version 3.0.15 Description A reflected Cross-Site Scripting issue allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application reflects the recipient value if ...

GHSA-3RX2-X6MX-GRJ3 Cross-site scripting in Apache JSPWiki

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the...