CVE-2020-3463: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient...

Microsoft SharePoint Cross-Site Scripting Vulnerability (CNVD-2020-64005)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A security...

Microsoft SharePoint Cross-Site Scripting Vulnerability (NVD-C-2020-180981)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

CVE-2020-6284

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

CVE-2020-6284

SAP NetWeaver Knowledge Management, versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content...

CVE-2020-6284

CVE-2020-6284 affects SAP NetWeaver Knowledge Management (versions 7.30, 7.31, 7.40, 7.50). The issue is a stored cross-site scripting (XSS) vulnerability caused by inadequate filtering when executing script content in a stored file. If an accessing user has administrative privileges, this could ...

PT-2020-13419

Name of the Vulnerable Software and Affected Versions RosarioSIS Student Information System versions prior to 6.5.1 Description The issue concerns a Reflected Cross-Site Scripting vulnerability. This allows remote attackers to execute arbitrary web script via embedding javascript or HTML tags in ...

CVE-2020-16275: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the Credential Manager component in SAINT Security Suite 8.0 through 9.8.20 could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link...

PT-2020-14865

Name of the Vulnerable Software and Affected Versions SAINT Security Suite versions 8.0 through 9.8.20 Description A cross-site scripting XSS issue in the Permissions component could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafted link...

PT-2020-14862

Name of the Vulnerable Software and Affected Versions SAINT Security Suite versions 8.0 through 9.8.20 Description A cross-site scripting XSS issue in the Credential Manager component could allow arbitrary script to run in the context of a logged-in user when the user clicks on a specially crafte...

DEBIAN-CVE-2020-11934

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this t...

CVE-2020-5613

Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL...

CVE-2020-11934: Exposure of Resource to Wrong Sphere

It was discovered that snapctl user-open allowed altering the $XDGDATADIRS environment variable when calling the system xdg-open. OpenURL in usersession/userd/launcher.go would alter $XDGDATADIRS to append a path to a directory controlled by the calling snap. A malicious snap could exploit this t...

CVE-2020-5613: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in KonaWiki 3.1.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL...

CVE-2020-5612: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability in KonaWiki 2.2.0 and earlier allows remote attackers to execute an arbitrary script via a specially crafted URL...

PT-2020-18583

Name of the Vulnerable Software and Affected Versions KonaWiki versions 2.2.0 and earlier Description A cross-site scripting issue allows remote attackers to execute an arbitrary script via a specially crafted URL. Recommendations For versions 2.2.0 and earlier, update to a version later than 2.2...

SilverStripe has an unspecified vulnerability (CNVD-2020-44911)

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . SilverStripe 4.5 and previous versions of a security vulnerability , attackers can use...

Remote Code Execution in scratch-vm

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code...

GHSA-VC9J-FHVV-8VRF Remote Code Execution in scratch-vm

MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code...

RosarioSIS Cross-Site Scripting Vulnerability (CNVD-2020-42950)

RosarioSIS is a student information system for school management. A cross-site scripting vulnerability exists in RosarioSIS 6.7.2. The vulnerability stems from improper validation of user-supplied input in the Preferences.php script. A remote attacker can exploit the vulnerability by using the ta...