GHSA-FPQV-X9HM-35J9 Cross-site Scripting vulnerability in Kitodo.Presentation

Impact Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting XSS. Only sites using the ListView, Navigation or PageView plugins are affected. It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site...

PT-2020-14747

Name of the Vulnerable Software and Affected Versions dlf aka Kitodo.Presentation versions prior to 3.1.2 dlf aka Kitodo.Presentation version 2.3.1 and earlier in the 2.x branch Description The issue is related to Cross Site Scripting XSS due to the failure to properly encode URL parameters for...

Cross site scripting

A Cross-Site Scripting XSS vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters through which installed packages names and versions are reported...

CVE-2020-15883

A Cross-Site Scripting XSS vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters through which installed packages names and versions are reported...

CVE-2020-15883: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability in the managedinstalls module before 2.6 for MunkiReport allows remote attackers to inject arbitrary web script or HTML via the last two URL parameters through which installed packages names and versions are reported...

PT-2020-14684

Name of the Vulnerable Software and Affected Versions MunkiReport versions prior to 2.6 Description A Cross-Site Scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the last two URL parameters, which report installed packages names and versions...

CVE-2020-14202

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

Design/Logic Flaw

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

CVE-2020-14202

WebFOCUS Business Intelligence 8.0 (SP6) is affected by CVE-2020-14202: an XSS vulnerability via arbitrary URL parameters in WebFOCUS BI. The root cause is insufficient input sanitization/cleanup, allowing script execution in the context of the affected site. Impact is cross-site scripting; no ex...

CVE-2020-14202

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

CVE-2020-14202: Improper Neutralization of Input During Web Page Generation

WebFOCUS Business Intelligence 8.0 SP6 was prone to XSS via arbitrary URL parameters...

PT-2020-13928

Name of the Vulnerable Software and Affected Versions WebFOCUS Business Intelligence version 8.0 SP6 Description The issue allows for cross-site scripting XSS attacks via arbitrary URL parameters. Recommendations For WebFOCUS Business Intelligence version 8.0 SP6, consider restricting access to...

CVE-2020-7932

OMERO.web before 5.6.3 optionally allows sensitive data elements e.g., a session key to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target...

CVE-2019-11843

The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL Reflective Server-Side XSS...

CVE-2020-4226

IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207...

CVE-2020-4226

IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207...

CVE-2020-4226: Exposure of Sensitive Information to an Unauthorized Actor

IBM MobileFirst Platform Foundation 8.0.0.0 stores highly sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 175207...

PT-2020-17928

Name of the Vulnerable Software and Affected Versions IBM MobileFirst Platform Foundation version 8.0.0.0 Description The issue concerns the storage of highly sensitive information in URL parameters, which may lead to information disclosure if unauthorized parties have access to the URLs via serv...

Security Bulletin: User Credentials submitted using GET method

Summary IBM Worklight/MobileFoundation has addressed the following vulnerability. User Credentials submitted using GET method Vulnerability Details CVEID: CVE-2020-4226 DESCRIPTION: IBM WorkLight stores highly sensitive information in URL parameters. This may lead to information disclosure if...

CVE-2020-6213

SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXTPHTMLB, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754, is vulnerable to reflected Cross-Site Scripting XSS via different URL parameters as it does not sufficiently encode user controlled inputs...