CVE-2021-38707: Improper Neutralization of Input During Web Page Generation

Persistent cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session...

PT-2021-22268

Name of the Vulnerable Software and Affected Versions ClinicCases version 7.3.3 Description The issue allows low-privileged attackers to introduce arbitrary JavaScript to account parameters, resulting in persistent cross-site scripting XSS vulnerabilities. The XSS payloads will execute in the...

PT-2021-22265

Name of the Vulnerable Software and Affected Versions ClinicCases version 7.3.3 Description The issue allows unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL, resulting in account takeover via session token theft. This is due to multiple reflected cross-site...

CVE-2021-38704: Improper Neutralization of Input During Web Page Generation

Multiple reflected cross-site scripting XSS vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft...

ClinicCases 跨站脚本漏洞

ClinicCases is an open source case management system designed for law school clinics. A cross-site scripting vulnerability exists in ClinicCases version 7.3.3 that stems from the software's lack of effective validation and filtering of user-submitted parameters. The vulnerability allows an...

CVE-2021-1073: Undefined Security Weakness

NVIDIA GeForce Experience, all versions prior to 3.23, contains a vulnerability in the login flow when a user tries to log in by using a browser, while, at the same time, any other web page is loaded in other tabs of the same browser. In this situation, the web page can get access to the token of...

CVE-2021-27945: Improper Neutralization of Input During Web Page Generation

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting XSS vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who...

CVE-2020-1631 Out of Cycle Security Advisory: Junos OS: Security vulnerability in J-Web and web based (HTTP/HTTPS) services

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...

CVE-2020-1631

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN DVPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning ZTP allows an unauthenticated attacker to perform local file inclusion LFI or path traversal. Using this vulnerability...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

Cross site scripting

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2020-5393: Improper Neutralization of Input During Web Page Generation

In Appspace On-Prem through 7.1.3, an adversary can steal a session token via XSS...

CVE-2019-12836: Cross-Site Request Forgery (CSRF)

The Bobronix JEditor editor before 3.0.6 for Jira allows an attacker to add a URL/Link to an existing issue that can cause forgery of a request to an out-of-origin domain. This in turn may allow for a forged request that can be invoked in the context of an authenticated user, leading to stealing ...

PT-2019-12976

Name of the Vulnerable Software and Affected Versions Bobronix JEditor for Jira versions prior to 3.0.6 Description The issue allows an attacker to add a URL/Link to an existing issue that can cause forgery of a request to an out-of-origin domain. This may lead to a forged request being invoked i...

CVE-2018-12302

Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting...

PT-2019-8889

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1 Description The issue concerns a missing HTTPOnly flag on session cookies in the web application of Seagate NAS OS, which allows attackers to steal session tokens via cross-site scripting. Recommendations For...

CVE-2018-12302: Improper Neutralization of Input During Web Page Generation

Missing HTTPOnly flag on session cookies in the Seagate NAS OS version 4.3.15.1 web application allows attackers to steal session tokens via cross-site scripting...

Cross-Site Scripting (XSS)

validator is vulnerable to cross-site scripting. A remote attacker is able to bypass XSS filters via nested forbidden strings to inject arbitrary Javascript into a victim’s browser to steal session tokens or perform unwanted actions on behalf of the user...

UBUNTU-CVE-2018-7563

An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The...