PT-2023-12533 · Ubit Information Technologies · Ubit Information Technologies Student Information Management System

Name of the Vulnerable Software and Affected Versions: UBIT Information Technologies Student Information Management System versions before 20211126 Description: The issue is related to Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic XSS. This allows for...

PT-2023-21150 · Unknown · Quickentity-Editor-Next

Name of the Vulnerable Software and Affected Versions: quickentity-editor-next versions prior to 1.28.1 Description: The issue concerns an open source, system local, video game asset editor. In affected versions, HTML tags in entity names are not sanitized, leading to an XSS vulnerability. This...

Microsoft Windows Untrusted Script Execution Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing o...

SUSE CVE-2010-4524

Cross-site scripting XSS vulnerability in lib/mhtxthtml.pl in MHonArc 2.6.16 allows remote attackers to inject arbitrary web script or HTML via a malformed start tag and end tag for a SCRIPT element, as demonstrated by ipt and ipt sequences...

CVE-2022-39371

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has...

CVE-2022-38771

The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request...

Cross site request forgery (csrf)

The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request...

CVE-2022-38771: Improper Neutralization of Special Elements used in an SQL Command

The mobile application in Transtek Mojodat FAM Fixed Asset Management 2.4.6 allows remote attackers to send SCRIPT tags as injected input to the API request...

Siemens Scripting XSS

The vulnerability of Siemens’ software and hardware infrastructure is related to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

TrueConf Server XSS

The vulnerability of the /admin/group/list/ component of the TrueConf Server relates to the failure to remove script-related HTML tags from web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

ArgoCD XSS

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to the lack of measures taken to eliminate script-related HTML tags on the web page. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks...

CVE-2022-25238

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

CVE-2022-25238: Improper Neutralization of Input During Web Page Generation

Silverstripe silverstripe/framework through 4.10.0 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

Java Runtime Environment Script Tag Removal

The vulnerability of the Java Runtime Environment software relates to the failure to remove scipt-related tags from web pages. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the protected information...

SCALANCE X302-7 EEC XSS

The vulnerability of the microprogrammed software in industrial switches SCALANCE X302-7 EEC, SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE...

Cross site scripting in Apache Sling

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

Cisco Firepower Management Center XSS

The vulnerability in the web interface for managing Cisco Firepower Management Center FMC software involves the failure to remove script-related HTML tags from the web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Combodo iTop Cross-Site Scripting Vulnerability

Combodo iTop is a French company Combodo ITIL-based development and for the daily operation of the IT environment of open source Web applications. The program provides incident management, configuration management, and problem management functionality. A cross-site scripting vulnerability exists ...

Cross site scripting

VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window...

CVE-2022-22944: Improper Neutralization of Input During Web Page Generation

VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. Due to insufficient sanitization and validation, in VMware Workspace ONE Boxer calendar event descriptions, a malicious actor can inject script tags to execute arbitrary script within a user's window...