CVE-2020-8498

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...

CVE-2020-8498

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...

CVE-2020-8498

XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users e.g., ones who have t...

PT-2020-6118

Name of the Vulnerable Software and Affected Versions Bitrix24 affected versions not specified Description The issue exists due to insufficient input validation of the arParamsAPI KEY parameter in the map.google component of the Bitrix24 business management service. This could allow a remote...

Command injection

In BIG-IP APM portal access on versions 15.0.0-15.1.0, 14.0.0-14.1.2.3, 13.1.0-13.1.3.2, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, when backend servers serve HTTP pages with special JavaScript code, this can lead to internal portal access name conflict...

CVE-2019-18588

CVE-2019-18588 is a Cross‑Site Scripting (XSS) vulnerability in Dell EMC Unisphere for PowerMax and PowerMax OS. Authenticated attackers could inject JavaScript to affect other authenticated sessions. Affected products: Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9 and prior to 9.0.2....

Cross site scripting

IBM Cognos Analytics 11.0 and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168924...

Cross-site Scripting (XSS)

wordpress is vulnerable to cross-site scripting XSS. The vulnerability exists as authenticated users can inject JavaScript code in the block editor that will be executed when it is rendered...

CVE-2019-16781

In WordPress before 5.3.1, authenticated users with lower privileges like contributors can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS...

CVE-2019-4744

IBM Financial Transaction Manager 3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172882...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale which allows users to embed arbitrary JavaScript code in the Web UI (CVE-2019-4665)

Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale that could allow users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. A fix for this...

Security Bulletin: A cross site scripting security vulnerability has been identified with Case Builder component in IBM Case Manager (CVE-2019-4426)

Summary Case Builder component shipped in IBM Case Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Sql injection

An injection issue was addressed with improved validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

CVE-2019-8792

An injection issue was addressed with improved validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

PT-2019-19220

Name of the Vulnerable Software and Affected Versions Shazam Android App versions prior to 9.25.0 Shazam iOS App versions prior to 12.11.0 Description The issue concerns an injection problem that has been addressed through improved validation. Processing a maliciously crafted URL may lead to...

CVE-2019-8792: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An injection issue was addressed with improved validation. This issue is fixed in Shazam Android App Version 9.25.0, Shazam iOS App Version 12.11.0. Processing a maliciously crafted URL may lead to arbitrary javascript code execution...

PT-2019-17056

Name of the Vulnerable Software and Affected Versions HCL AppScan Source versions 9.0.3.13 and earlier Description The issue allows users to embed arbitrary JavaScript code in the Web UI, making it susceptible to cross-site scripting XSS attacks. Recommendations For versions 9.0.3.13 and earlier,...

Serv-U FTP Server Cross-Site Scripting Vulnerability

Serv-U is an award-winning FTP server software developed by Rob Beckers, full name: Serv-U FTP Server. FTP server users can share files on the internet through it using the FTP protocol. Serv-U FTP Server cross-site scripting vulnerability can be exploited by attackers to execute Javascript code...

CVE-2019-4663

IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 17124...

CVE-2019-4428

IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...