CVE-2020-1673

Insufficient Cross-Site Scripting XSS protection in Juniper Networks J-Web and web based HTTP/HTTPS services allows an unauthenticated attacker to hijack the target user's HTTP/HTTPS session and perform administrative actions on the Junos device as the targeted user. This issue only affects Junip...

CVE-2020-26522

A cross-site request forgery CSRF vulnerability in mod/user/actuser.php in Garfield Petshop through 2020-10-01 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts...

HPE KVM IP Console Switches Cross-Site Scripting Vulnerability

HPE KVM IP Console Switches is an HP switch device. A cross-site scripting vulnerability exists in HPE KVM IP Console Switches, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack...

CVE-2019-19393

The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.002 to V3.15.704 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content such as JavaScript or other client-side scripts as the...

CVE-2018-6447

A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0CBN3, v7.4.2g could allow authenticated attackers with access to the web interface to hijack a user’s session and take over the account...

CVE-2018-6447

A Reflective XSS Vulnerability in HTTP Management Interface in Brocade Fabric OS versions before Brocade Fabric OS v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0CBN3, v7.4.2g could allow authenticated attackers with access to the web interface to hijack a user’s session and take over the account...

CVE-2020-24594

Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka XSS. A successful exploit could allow an attacker to gain access to a user session...

DEBIAN-CVE-2020-8201

Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...

UBUNTU-CVE-2020-8201

Node.js 12.18.4 and 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture ...

PT-2020-5068 · Node.Js +6 · Node.Js +6

Name of the Vulnerable Software and Affected Versions: Node.js versions prior to 12.18.4 Node.js versions prior to 14.11 Description: The issue is related to an error in processing HTTP header names, which can be exploited by a remote attacker to gain access to protected information or elevate...

WordPress Click To Top Plugin Stored Cross-Site Scripting Vulnerability

WordPress is a blogging platform based on the PHP language, which can be used to set up a website on a server that supports PHP and MySQL databases, and can also be used as a content management system CMS. A stored cross-site scripting vulnerability exists in the WordPress Click To Top plugin. An...

F5 BIG-IP AFM Configuration Tool Cross-Site Scripting Vulnerability

The F5 BIG-IP AFM is an advanced firewall device. The F5 BIG-IP AFM Configuration Tool suffers from a cross-site scripting vulnerability that can be exploited by remote attackers to inject malicious script or HTML code, which can be used to gain access to sensitive information or hijack user...

ASUS RT-AC1900P routers cross-site scripting vulnerability

ASUS RT-AC1900P routers is a router device. A cross-site scripting vulnerability exists in the ASUS RT-AC1900P routers firmware update page, which can be exploited by remote attackers to inject malicious script or HTML code that can be used to gain access to sensitive information or hijack user...

Rocket.Chat: Session Hijack via Self-XSS

Summary: It's possible to hijack a session by tricking the user to perform a Self-XSS on the drag and drop functionality in the chat. Description: Self-XSS is an underrated vulnerability that can have a harmful impact on the users of the application like here, after we get access to the user's...

Teradici PCoIP Management Console Cross-Site Scripting Vulnerability

Teradici PCoIP Management Console is a console program for managing PCoIP clients from Teradici Canada. A cross-site scripting vulnerability exists in Teradici PCoIP Management Console versions prior to 20.07. The vulnerability stems from a lack of proper validation of client data by the web...

CVE-2020-13183

Reflected Cross Site Scripting in Teradici PCoIP Management Console prior to 20.07 could allow an attacker to take over the user's active session if the user is exposed to a malicious payload...

[SECURITY] [DLA 2319-1] xrdp security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2319-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 09, 2020 https://wiki.debian.org/LTS -...

CVE-2020-7576

A vulnerability has been identified in Camstar Enterprise Platform All versions, Opcenter Execution Core All versions V8.2, Opcenter Execution Core V8.2. An authenticated user with the ability to create containers, packages or register defects could perform stored Cross-Site Scripting XSS attacks...

PT-2020-19633 · Siemens · Opcenter Execution Core +1

Name of the Vulnerable Software and Affected Versions: Camstar Enterprise Platform versions all Opcenter Execution Core versions prior to V8.2 Opcenter Execution Core version V8.2 Description: A stored Cross-Site Scripting XSS attack can be performed by an authenticated user with the ability to...

CVE-2020-3297

A vulnerability in session management for the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthenticated, remote attacker to defeat authentication protections and gain unauthorized access to the management interface. The attacker could obtain the...