Cross site scripting

A stored cross-site scripting Stored XSS vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board where they have BoardAdmin access,...

CVE-2020-23065

Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remote authenticated attacker to execute arbitrary code via the video-js.swf...

CVE-2023-28485

A stored cross-site scripting Stored XSS vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board where they have BoardAdmin access,...

CVE-2023-28485

A stored cross-site scripting Stored XSS vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board where they have BoardAdmin access,...

PT-2023-25496 · Ateme · Ateme Flamingo Xl

Name of the Vulnerable Software and Affected Versions: Ateme Flamingo XL version 3.6.20 Ateme Flamingo XS version 3.6.5 Description: The issue allows a remote authenticated attacker to execute arbitrary code and cause a denial of service via the session expiration function. Recommendations: For...

jenkins-2-plugin: workflow-job: Stored XSS vulnerability in Pipeline: Job Plugin

A flaw was found in the Jenkins Pipeline: Job Plugin. Affected versions of Jenkins Pipeline: Job Plugin are vulnerable to Cross-site scripting caused by improper validation of user-supplied input. This flaw allows a remote authenticated attacker to inject malicious script into a Web page, which...

Security Bulletin: IBM Spectrum Control is vulnerable to weakness related to Apache Kafka

Summary Vulnerability in Apache Kafka allow a remote authenticated attacker to execute arbitrary code may affect IBM Spectrum Control. Vulnerability Details CVEID:CVE-2023-25194 DESCRIPTION: Apache Kafka could allow a remote authenticated attacker to execute arbitrary code on the system, caused b...

Synology Router Manager (SRM) 1.1.x DoS Vulnerability (Synology-SA-17:49)

Synology Router Manager SRM is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Synology Router Manager (SRM) 1.2.x, 1.3.x Uncontrolled Search Path Element Privilege Escalation Vulnerability (Synology-SA-23:06)

Synology Router Manager SRM is prone to an uncontrolled search path element privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2022-32752

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 228439...

CVE-2022-32752

CVE-2022-32752 affects IBM Security Directory Suite VA 8.0.1 through 8.0.1.19. A remote authenticated attacker can execute arbitrary commands on the system by sending a specially crafted request. IBM’s advisory and related sources identify the affected product and provide a fix: update to IBM Sec...

Path traversal

Uncontrolled search path element vulnerability in Backup Management Functionality in Synology DiskStation Manager DSM before 7.1-42661 allows remote authenticated users to read or write arbitrary files via unspecified vectors...

CVE-2023-0142

Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager DSM before 6.2.4-25556-8, 7.0.1-42218-7 and 7.1-42661 allows remote authenticated users with administrator privileges to read or write arbitrary files via unspecified vectors...

CVE-2023-31198

OS command injection vulnerability exists in Wi-Fi AP UNIT allows. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. Affected products and versions are as follows: AC-PD-WAPU v1.05B04 and earlier, AC-PD-WAPUM...

PT-2023-3035 · Cisco · Cisco Telepresence Video Communication Server +1

Name of the Vulnerable Software and Affected Versions: Cisco Expressway Series and Cisco TelePresence Video Communication Server VCS affected versions not specified Description: A vulnerability in the change password functionality could allow an authenticated, remote attacker with Read-only...

Cross-Site Scripting (XSS)

com.liferay:com.liferay.account.admin.web is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the special characters before it output to the front end, allowing a remote authenticated attacker to inject and execute malicious JavaScript on victim's browser via a...

Schweitzer Engineering Laboratories RTAC Improper Input Validation (CVE-2023-31148)

An Improper Input Validation vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to execute arbitrary code. See SEL Service Bulletin dated 2022-11-15 for more details. This plugin only works wi...

Schweitzer Engineering Laboratories RTAC Cross-site Scripting (CVE-2023-31164)

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in the Schweitzer Engineering Laboratories Real-Time Automation Controller SEL RTAC Web Interface could allow a remote authenticated attacker to inject and execute arbitrary script code. See SEL...

CVE-2023-30758

Cross-site scripting vulnerability in Pleasanter 1.3.38.1 and earlier allows a remote authenticated attacker to inject an arbitrary script...

PT-2023-22958 · Unknown · Pleasanter

Name of the Vulnerable Software and Affected Versions: Pleasanter versions 1.3.38.1 and earlier Description: A cross-site scripting issue allows a remote authenticated attacker to inject an arbitrary script. Recommendations: For versions 1.3.38.1 and earlier, at the moment, there is no informatio...