Cisco Unified Communications Manager WEB Interface Cross-Site Scripting Vulnerability

Cisco Unified Communications Manager is a unified communications solution. A cross-site scripting vulnerability exists in the Cisco Unified Communications Manager WEB interface, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used t...

Cross-Site Scripting (XSS)

jspwiki-war is vulnerable to cross-site scripting XSS. The remember parameter in preview.jsp was not handled properly to escape malicious script injection, allowing to trigger the attack through it...

Cross-Site Scripting (XSS)

padrino-contrib is vulnerable to cross-site scripting XSS. The caption parameter in the function sethome of breadcrumbs.rb is not escaped properly to prevent injection of malicious script through it, allowing an attacker to steal session tokens or perform unwanted actions on behalf of the user...

Cross-site Scripting (XSS)

nodebb is vulnerable to cross-site scripting XSS. The attack exists because it does not have basic protection from XSS and relies on the plugins to perform sanitization of all the parsed content, allowing an attacker to inject malicious script if any of the plugins get disabled...

Security Bulletin: IBM Cloud Automation Manager is affected by a insecure Content-Security-Policy header vulnerability CVE-2019-4133

Summary IBM Cloud Automation Manager could allow a malicious user on the client side with access to client computer to run a custom script. Vulnerability Details CVEID: CVE-2019-4133 DESCRIPTION: IBM Cloud Automation Manager could allow a malicious user on the client side with access to client...

Cross-site Scripting (XSS)

kevinpapst/kimai2 is vulnerable to cross-site scripting XSS. It does not escape the timesheet description, allowing an attacker to inject a malicious script via that description...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in transaction description field and in asset account name, allowing an attacker to inject malicious script in a convert transaction to get executed upon ...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data increate-from-bill name field, allowing an attacker to inject malicious script...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in liability name field, allowing an attacker to inject malicious script in a transaction to get executed upon an error condition during a visit to the...

Cross-site Scripting (XSS)

invenio-records is vulnerable to cross-site scripting XSS. When an admin user views a new record uploaded by a user with permission to upload in the admin interface, it directly renders JSON output for the new record, allowing the user to inject and render any arbitrary malicious script to render...

CVE-2019-3414

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

Cross site scripting

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

CVE-2019-3414

All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS, when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user, the malicious script code could be transmitted in the parameter. If the front...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack exists because it does not validate the file content provided by the user, allowing an attacker to inject a malicious script through it to get executed during viewing of attachments/view/$fileid$ attachment...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS attacks. The attack is due to lack of sanitization of query string provided by the user in the search query, allowing an attacker to inject a malicious script...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack exists because it does not validate the file name provided by the user, allowing an attacker to inject a malicious script through it to get executed during editing of attachments/edit/$fileid$ attachment...

Cross-site Scripting (XSS)

grumpydictator/firefly-iii is vulnerable to cross-site scripting XSS. The attack is possible because it does not escape the user provided data in budget name, allowing an attacker to inject malicious script in a transaction to get executed on the tags/show/$tagnumber$ tag summary page...

Cross-site Scripting (XSS)

mediawiki is vulnerable to cross-site scripting XSS. The attack is possible because it allows the creation of a page that does not correspond to any user, e.g User:Foo/bar.js. Subsequently, an attacker will be able to create an account User:Foo and create a malicious script bar.js, which causes t...

Denial Of Service (DoS)

brave-browser is vulnerable to denial of service. An attacker is able to exploit a bug in the application by using a malicious script to close a non-existing tab. This causes the application to crash...

Design/Logic Flaw

XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements, the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of...