CVE-2020-35203: Improper Neutralization of Input During Web Page Generation

Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported b...

PT-2021-11837 · Quest · Quest Policy Authority

Name of the Vulnerable Software and Affected Versions: Quest Policy Authority version 8.1.2.200 Description: The issue allows remote attackers to inject malicious code into the browser via a specially crafted link to the "/WebCM/index.jsp" file using the msg parameter. This affects products that...

CVE-2020-35725: Improper Neutralization of Input During Web Page Generation

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Quest Software Policy Authority For Unified Communications 跨站脚本漏洞

Quest Policy Authority For Unified Communications is a software from Quest, Inc. that is used in corporate environments to consolidate communication data between various media text and instant messaging, video conferencing, email and voicemail. A cross-site scripting vulnerability exists in Quest...

Microsoft Outlook MSG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Outlook. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2020-27742

An Insecure Direct Object Reference vulnerability in Citadel WebCit through 926 allows authenticated remote attackers to read someone else's emails via the msgconfirmmove template. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" threa...

CVE-2019-12000

HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used between the USSD and an external USSD service logic application. Update to version 3.2 and update the HTTPS configuration as described in the HPE MSE Messaging...

CVE-2019-12000

CVE-2019-12000 relates to the HPE MSE Msg Gw application E-LTU prior to version 3.2, where a potential Remote Access Restriction Bypass exists when HTTPS is used between the USSD and an external USSD service logic application. Affected component: HPE MSE Messaging Gateway (E-LTU); root cause: ins...

CVE-2019-12000: Improper Certificate Validation

HPE has found a potential Remote Access Restriction Bypass in HPE MSE Msg Gw application E-LTU prior to version 3.2 when HTTPS is used between the USSD and an external USSD service logic application. Update to version 3.2 and update the HTTPS configuration as described in the HPE MSE Messaging...

CVE-2020-13443: Unrestricted Upload of File with Dangerous Type

ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg, Add attachment, and Save As Draft actions. A user with low privileges member is able to upload this. It is possible to bypass the MIME type check and file-extension check...

Node.js third-party modules: [commit-msg] RCE via insecure command formatting

I would like to report a RCE issue in the commit-msg module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: commit-msg version: 0.2.3 npm page: https://www.npmjs.com/package/commit-msg Module Description commit-msg is a customizable git commit message...

The vulnerability of the lsi_do_msgin function in the QEMU hardware emulation software, related to reading beyond the data buffer, allows a hacker to trigger a service failure.

The vulnerability of the lsidomsgin function hw/scsi/lsi53c895a.c in the QEMU hardware emulation software is related to reading beyond the buffer data boundary. Exploiting this vulnerability can allow an attacker to cause a service failure due to an invalid value of the msglen variable...

CVE-2019-15482

selectize-plugin-a11y before 1.1.0 has XSS via the msg field...

CVE-2019-15482

The CVE-2019-15482 entry concerns the package selectize-plugin-a11y prior to version 1.1.0, where a Cross-Site Scripting (XSS) vulnerability exists in the msg field. The root cause, as described in the Node.js advisory, is that the accessibility.liveRegion.speak function does not sanitize the msg...

CVE-2019-15482: Improper Neutralization of Input During Web Page Generation

selectize-plugin-a11y before 1.1.0 has XSS via the msg field...

PT-2019-13577 · Mcpp +1 · Mcpp +1

Name of the Vulnerable Software and Affected Versions: MCPP version 2.7.2 Description: The issue is a heap-based buffer overflow in the do msg function located in support.c. This overflow can potentially lead to arbitrary code execution, allowing an attacker to execute malicious code on the...

DEBIAN-CVE-2018-18849

In Qemu 3.0.0, lsidomsgin in hw/scsi/lsi53c895a.c allows out-of-bounds access by triggering an invalid msglen value...

CVE-2018-13893: Improper Restriction of Operations within the Bounds of a Memory Buffer

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, Out of bound mask range access caused by using possible old value of msg mask table count while copying masks to userspace...

Microstrategy Web Cross-Site Scripting Vulnerability (CNVD-2018-23268)

MicroStrategy Web is a highly interactive, easy-to-use application for report analysis and continuous business monitoring. A cross-site scripting vulnerability exists in Microstrategy Web 7. The vulnerability stems from Microstrategy Web failing to adequately encode user-controlled input. An...

CVE-2018-18775

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability via the Login.asp Msg parameter. NOTE: this is a deprecated product...