IBM Concert 跨站脚本漏洞

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert suffers from a cross-site scripting vulnerability that stems from allowing an unauthenticated attacker to embed arbitrary JavaScript code i...

CVE-2024-45642

IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-45099

IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2024-31430 · Ibm · Ibm Security Reaqta

Name of the Vulnerable Software and Affected Versions: IBM Security ReaQta version 3.12 Description: This issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

CVE-2024-33510

An improper neutralization of special elements in output used by a downstream component 'Injection' vulnerability CWE-74 in FortiOS version 7.4.3 and below, version 7.2.8 and below, version 7.0.16 and below; FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below;...

Cisco IP Phone 跨站脚本漏洞

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. The Cisco IP Phone suffers from a cross-site scripting vulnerability that stems from the affected device's WebUI not properly validating user-supplied input. An authenticated,...

IBM Maximo Application Suite 跨站脚本漏洞

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Maximo Application Suite. The vulnerability stems fro...

Cisco IP Phone 跨站脚本漏洞

The Cisco IP Phone is a hardware device from Cisco, Inc. IP Phone that provides calling capabilities. The Cisco IP Phone suffers from a cross-site scripting vulnerability that stems from the affected device's WebUI not properly validating user-supplied input. An authenticated, remote attacker cou...

Cisco IP Phone 信息泄露漏洞

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. The Cisco IP Phone suffers from an information disclosure vulnerability that stems from improper storage of sensitive information in the Web UI of the Session Initiation Protoco...

CVE-2024-41745

IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2024-29551 · Ibm · Ibm Cics Tx Standard

Name of the Vulnerable Software and Affected Versions: IBM CICS TX Standard affected versions not specified Description: The issue allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials...

IBM CICS TX Standard 跨站脚本漏洞

IBM CICS TX Standard is a comprehensive single transaction runtime package from International Business Machines IBM, Inc. It can provide a cloud-native deployment model for standalone applications. A cross-site scripting vulnerability exists in IBM CICS TX Standard version 11.1, which stems from...

IBM CICS TX Standard 安全漏洞

IBM CICS TX Standard is a comprehensive single-transaction runtime package from International Business Machines IBM that provides a cloud-native deployment model for standalone applications. A cross-site request forgery vulnerability exists in the IBM CICS TX Standard Web UI, which can be exploit...

CVE-2024-41153

Command injection vulnerability in the Edge Computing UI for the TRO600 series radios that allows for the execution of arbitrary system commands. If exploited, an attacker with write access to the web UI can execute commands on the device with root privileges, far more extensive than what the wri...

LoLLMs 访问控制错误漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. An access control error vulnerability exists in LoLLMs versions prior to v10 that stems from the presence of a CORS configuration error that can be exploited by an attacker to steal sensitive...

CVE-2024-49367

CVE-2024-49367 affects Nginx UI prior to version 2.0.0-beta.36. The issue is a controllable log path that, when combined with directory traversal at the /api/configs endpoint, allows reading directories and file contents on the server. A fixed version is 2.0.0-beta.36. Connected sources confirm t...

IBM WebSphere Application Server 跨站脚本漏洞

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A cross-site scripting vulnerability exists in IBM...

OSS Endpoint Manager 路径遍历漏洞

OSS Endpoint Manager is a FreePBX Contributed Modules open source module for FreePBX. A path traversal vulnerability exists in OSS Endpoint Manager version 14.0.3 and prior versions, which originates from allowing unauthorized access by an authenticated Web user to read system files with the...

PT-2024-31417 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 through 9.0 Description: This issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure...

LayUI 安全漏洞

Layui is a set of Web UI component libraries that follow the original development model of Layui open source. A security vulnerability exists in LayUI prior to version 2.9.17, which stems from pages containing uncleaned tags...