PT-2020-9973

Name of the Vulnerable Software and Affected Versions: Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9 Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16 Dell EMC PowerMax OS versions 5978.221.221 and 5978.479.479 Description: The issue allows an authenticated malicious user to...

PT-2020-9628

Name of the Vulnerable Software and Affected Versions Billion Smart Energy Router SG600R2 Firmware version 3.02.rc6 Description The issue allows an attacker to inject arbitrary HTML/JavaScript code, achieving client-side code execution. This is done via crafted DHCP request packets to the "etc...

DEBIAN-CVE-2019-16780

WordPress users with lower privileges like contributors can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This...

CVE-2019-16781

In WordPress before 5.3.1, authenticated users with lower privileges like contributors can inject JavaScript code in the block editor, which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS...

CVE-2019-16781

WordPress CVE-2019-16781 affects WordPress versions before 5.3.1. Authenticated users with low privileges (e.g., contributors) can inject JavaScript in the block editor, which runs in the admin dashboard and can lead to an admin opening the affected post in the editor, enabling XSS. Remediation: ...

CVE-2019-16780

WordPress users with lower privileges like contributors can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This...

CVE-2019-16780

WordPress users with lower privileges like contributors can inject JavaScript code in the block editor using a specific payload, which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This...

CVE-2019-19908

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmcusername parameter to passreset.php is vulnerable...

PT-2019-17126

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics version 11.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2019-17154

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager version 3.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2019-19908: Improper Neutralization of Input During Web Page Generation

phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL, the pmcusername parameter to passreset.php is vulnerable...

MTN Group: Cross-Site Scripting through search form on mtnplay.co.zm

Summary: There is a XSS vulnerability that can be triggered through a search form on mtnplay.co.zm Steps To Reproduce: 1. Navigate to http://www.mtnplay.co.zm/smart/jqm.aspx 2. Click on the search button or go to this link: http://www.mtnplay.co.zm/smart/jqm.aspx?event=search&mnu=search&ctrlid=92...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

CVE-2019-4388: Improper Neutralization of Input During Web Page Generation

HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting XSS attacks by allowing users to embed arbitrary JavaScript code in the Web UI...

PT-2019-17078

Name of the Vulnerable Software and Affected Versions IBM Case Manager versions 5.1.1 through 5.3 The Case Builder component versions 18.0.0.1 through 19.0.0.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially...

CVE-2019-4426: Improper Neutralization of Input During Web Page Generation

The Case Builder component shipped with 18.0.0.1 through 19.0.0.2 and IBM Case Manager 5.1.1 through 5.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

Webform - Critical - Multiple vulnerabilities - SA-CONTRIB-2019-096

This module enables you to create forms to collect information from users and report, analyze and distribute it by email. The 7.x-3.x module doesn't sufficiently sanitize token values taken from query strings. If a query string token is used as the value of a markup component, an attacker can...

IBM WebSphere Application Server Liberty Cross-Site Scripting Vulnerability

IBM WebSphere Application Server Liberty is a U.S. IBM company built on the Open Liberty project on top of the Java application server . A cross-site scripting vulnerability exists in IBM WebSphere Application Server Liberty versions 17.0.0.3 through 19.0.0.11. A remote attacker can exploit this...