CVE-2018-4065

An exploitable cross-site scripting vulnerability exists in the ACEManager pingresult.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP ping request can cause reflected javascript code execution, resulting in the execution of javascript code running on the...

CVE-2019-3490: Improper Neutralization of Input During Web Page Generation

A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server OES allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1, OES2018, and...

UBUNTU-CVE-2018-8035

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC = 2.2.2 which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code...

PT-2019-11143 · Apache · Apache Uima Ducc

Name of the Vulnerable Software and Affected Versions: Apache UIMA DUCC versions 2.2.2 and earlier Description: The issue arises from insufficient filtering of user-supplied inputs in the javascript code of Apache UIMA DUCC, potentially leading to the unintended execution of user-supplied...

CVE-2019-7211: Improper Neutralization of Input During Web Page Generation

SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment...

PT-2019-2503

Name of the Vulnerable Software and Affected Versions БАРС.ЖКХ-Жилищный Фонд affected versions not specified Description The issue is related to insufficient protection of the web page structure in the БАРС.ЖКХ-Жилищный Фонд platform. An attacker can exploit this issue by using a specially crafte...

ZEIT: Reflected DOM-Based XSS On Due Lack Filter On Parameter ?next

Summary: Hello I found that the parameter next lacks filtering, allowing the attacker to exploit this vulnerability to redirect users to a malicious site + The Attacker Can Exploit this bug to redirect the user to Malcious Site + The attacker can execute JavaScript code in the user browser Becaus...

Arbitrary JavaScript Execution

Overview Versions of typed-function prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code. Recommendation Upgrade to version 0.10.6 or later. References - GitHub Commit - Snyk Report - GitHub...

GHSA-8P7V-2JVJ-V54R Apache Airflow vulnerable to Stored XSS

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views...

Google Chrome JavaScript Execution

The vulnerability of Google Chrome is related to errors in event handling by Apple. Exploiting this vulnerability can allow an attacker to execute JavaScript code...

GHSA-GM29-35C7-8CFW Cross-Site Scripting in buttle

All versions of buttle are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code. Recommendation No fix is currently available. Consider using a...

CVE-2019-10905

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

CVE-2019-10905

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

PT-2019-12083

Name of the Vulnerable Software and Affected Versions Parsedown versions prior to 1.7.2 Description The issue allows attackers to execute arbitrary JavaScript code if a script, already running on the affected page, executes the contents of any element with a specific class. This occurs because...

CVE-2019-10905: Improper Neutralization of Input During Web Page Generation

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

Expedition Migration Arbitrary JavaScript Execution

The vulnerability of the Network Configuration Transfer tool exists because no measures have been taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript or HTML code remotely...

CVE-2019-5514

VMware VMware Fusion 11.x before 11.0.3 contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware...

CB TAU Threat Intelligence Notification – Recent Emotet Campaign Leverages Phishing, PDFs & Droppers Impersonating Legitimate Applications

This past week, CB ThreatSight analysts were investigating suspicious events in an environment. This customer had installed the CB Defense sensor on a subset of systems in monitor only mode for evaluation. While investigating suspicious events, a CB ThreatSight analyst uncovered a new Emotet...

Apache JSPWiki Cross-Site Scripting Vulnerability

Apache JSPWiki is the U.S. Apache Apache Software Foundation of a Java-based , Servlet and JSP to build an open source WikiWiki engine . A security vulnerability exists in Apache JSPWiki versions 2.9.0 through 2.11.0.M2. The vulnerability can be exploited by an attacker to execute JavaScript code...

CVE-2019-10646

Wolf CMS v0.8.3.1 is affected by cross site scripting XSS in the module Add Snippet /?/admin/snippet/add. This allows an attacker to insert arbitrary JavaScript as user input, which will be executed whenever the affected snippet is loaded...